Resubmissions
14-03-2022 13:53
220314-q7ffkagbb2 1014-03-2022 13:10
220314-qev1jshfal 1014-03-2022 13:10
220314-qejmhsffd9 114-03-2022 13:09
220314-qeba5sffd4 114-03-2022 13:09
220314-qdstsshegp 125-02-2022 17:41
220225-v9edhaabek 1025-02-2022 17:33
220225-v49x8aabcr 1025-02-2022 17:26
220225-vz7masggh9 1025-02-2022 17:01
220225-vjlpwsggd5 10Analysis
-
max time kernel
406s -
max time network
409s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-02-2022 17:26
Static task
static1
General
-
Target
INV21029.exe
-
Size
577KB
-
MD5
740dd9c14dea0b98df6ad434abfe789e
-
SHA1
cbec4d898e68c12fb7dcaddb17d0aca16e8e0e7b
-
SHA256
35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6
-
SHA512
66041e42091e83889a6da93c4242a01a0a3122774dc2db8baf909fb0ec6b0d6e847183ac92a24f2ca99f99de7dd4abddddda4a908887f354e3a333202bc0a66e
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
civicinfluencers.net
gzhf8888.com
kuleallstar.com
palisadeslodgecondos.com
holyhirschsprungs.com
azalearoseuk.com
jaggllc.com
italianrofrow.xyz
ioewur.xyz
3a5hlv.icu
kitcycle.com
estate.xyz
ankaraescortvip.xyz
richclubsite2001.xyz
kastore.website
515pleasantvalleyway.com
sittlermd.com
mytemple.group
tiny-wagen.com
sharaleesvintageflames.com
mentalesteem.com
sport-newss.online
fbve.space
lovingtruebloodindallas.com
eaglehospitality.biz
roofrepairnow.info
mcrosfts-updata.digital
cimpactinc.com
greatnotleyeast.com
lovely-tics.com
douglas-enterprise.com
dayannalima.online
ksodl.com
rainbowlampro.com
theinteriorsfurniture.com
eidmueller.email
cg020.online
gta6fuzhu.com
cinemaocity.com
hopeitivity.com
savageequipment.biz
groceriesbazaar.com
hempgotas.com
casino-pharaon-play.xyz
ralfrassendnk-login.com
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs
-
Registers COM server for autorun 1 TTPs
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1552-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1552-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/548-75-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Executes dropped EXE 11 IoCs
Processes:
reqbqonire.exereqbqonire.exevgaqhvh.exeUnlocker1.9.2.exeDeltaTB.exeSetup.exeSetup.exeUnlocker.exeUnlocker.exeUnlocker.exevgaqhvh.exepid process 1316 reqbqonire.exe 1552 reqbqonire.exe 2488 vgaqhvh.exe 2184 Unlocker1.9.2.exe 2244 DeltaTB.exe 2272 Setup.exe 2888 Setup.exe 2120 Unlocker.exe 2828 Unlocker.exe 468 Unlocker.exe 2144 vgaqhvh.exe -
Modifies Installed Components in the registry 2 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Drops startup file 2 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini regsvr32.exe -
Loads dropped DLL 32 IoCs
Processes:
INV21029.exereqbqonire.exeWerFault.exeUnlocker1.9.2.exeDeltaTB.exerundll32.exeSetup.exeregsvr32.exeregsvr32.exeExplorer.EXEchrmstp.exeWerFault.exepid process 1556 INV21029.exe 1316 reqbqonire.exe 2188 WerFault.exe 2188 WerFault.exe 2188 WerFault.exe 2188 WerFault.exe 2184 Unlocker1.9.2.exe 2184 Unlocker1.9.2.exe 2184 Unlocker1.9.2.exe 2184 Unlocker1.9.2.exe 2244 DeltaTB.exe 1096 rundll32.exe 1096 rundll32.exe 1096 rundll32.exe 1096 rundll32.exe 2272 Setup.exe 2184 Unlocker1.9.2.exe 2320 regsvr32.exe 2680 regsvr32.exe 2272 Setup.exe 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 2356 chrmstp.exe 2572 WerFault.exe 2572 WerFault.exe 2572 WerFault.exe 2572 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
systray.exesidebar.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0BFLFTBPL = "C:\\Program Files (x86)\\Bmrxh\\vgaqhvh.exe" systray.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Windows\CurrentVersion\Run sidebar.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exeSetup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Drops desktop.ini file(s) 52 IoCs
Processes:
ie4uinit.exeregsvr32.exeregsvr32.exemctadmin.exeWinMail.exeExplorer.EXEExplorer.EXEregsvr32.exeWinMail.exedescription ioc process File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini ie4uinit.exe File opened for modification C:\Users\test\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Saved Games\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Saved Games\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Favorites\Links for United States\desktop.ini mctadmin.exe File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini regsvr32.exe File created C:\Users\test\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini WinMail.exe File opened for modification C:\Users\test\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini Explorer.EXE File opened for modification C:\Users\test\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini Explorer.EXE File opened for modification C:\Windows\assembly\Desktop.ini Explorer.EXE File opened for modification C:\$RECYCLE.BIN\S-1-5-21-2329389628-4064185017-3901522362-1001\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Contacts\desktop.ini WinMail.exe File opened for modification C:\Users\test\Searches\desktop.ini regsvr32.exe File opened for modification C:\Users\test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini ie4uinit.exe File opened for modification C:\Users\test\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Favorites\Links\desktop.ini ie4uinit.exe File opened for modification C:\Users\test\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\test\Searches\desktop.ini regsvr32.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
unregmp2.exeunregmp2.exedescription ioc process File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\F: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\test\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\test\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" regsvr32.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
reqbqonire.exereqbqonire.exesystray.exedescription pid process target process PID 1316 set thread context of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1552 set thread context of 1384 1552 reqbqonire.exe Explorer.EXE PID 1552 set thread context of 1384 1552 reqbqonire.exe Explorer.EXE PID 548 set thread context of 1384 548 systray.exe Explorer.EXE PID 548 set thread context of 2164 548 systray.exe Explorer.EXE -
Drops file in Program Files directory 64 IoCs
Processes:
Explorer.EXEUnlocker1.9.2.exesystray.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can.fca Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can129.hsp Explorer.EXE File opened for modification C:\Program Files\Unlocker\Unlocker.url Unlocker1.9.2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ahclient.dll Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\license.html Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CYRILLIC.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\warning.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt55.ths Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt Explorer.EXE File opened for modification C:\Program Files (x86)\Bmrxh\vgaqhvh.exe systray.exe File created C:\Program Files\Unlocker\UnlockerDriver5.sys Unlocker1.9.2.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\rss.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\eula.ini Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\submission_history.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt04.hsp Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\icudt26l.dat Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\bl.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa03.hsp Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\eng32.clx Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\UKRAINE.TXT Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt32.clx Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa37.hyp Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico Explorer.EXE File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe Explorer.EXE File created C:\Program Files\Unlocker\UnlockerCOM.dll Unlocker1.9.2.exe -
Drops file in Windows directory 64 IoCs
Processes:
Explorer.EXErundll32.exeie4uinit.exeExplorer.EXEdescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\Music Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcm80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E Explorer.EXE File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico Explorer.EXE File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\RMFFile_8.ico Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAutomationProvider_gac_x86 Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\NetworkService\Documents Explorer.EXE File opened for modification C:\Windows\INF\setupapi.app.log rundll32.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationHostDLL_x86.dll.mui Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_amd64 Explorer.EXE File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo Explorer.EXE File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index143.dat Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100kor_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PenIMC2_v0400_X86.dll Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\NetworkService\Desktop Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcp100_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\microsoft.build.tasks.v4.0.dll_gac_x86 Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\LocalService\Downloads Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu Explorer.EXE File opened for modification C:\Windows\assembly\Desktop.ini Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\microsoft.build.tasks.v4.0.dll_amd64 Explorer.EXE File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\grvicons.exe Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\LocalService\Pictures Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_atl100_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAutomationClient_gac_x86 Explorer.EXE File opened for modification C:\Windows\Installer\5367.msp Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\wpfgfx_x86.dll Explorer.EXE File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\xlicons.exe Explorer.EXE File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDXFile_8.ico Explorer.EXE File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index133.dat Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100enu_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\9.0.0\ul_msvcr80.dll.98CB24AD_52FB_DB5F_FF1F_C8B3B9A1E18E Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\NetworkService\Links Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\NetworkService\Pictures Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationNative_x86.dll Explorer.EXE File opened for modification C:\Windows\Installer\7411.msp Explorer.EXE File opened for modification C:\Windows\assembly\pubpol37.dat Explorer.EXE File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\LocalService\Videos Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAutomationTypes_amd64.dll Explorer.EXE File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe Explorer.EXE File opened for modification C:\Windows\Fonts\fms_metadata.xml Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100jpn_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\System_Xaml_gac_x86 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\PresentationFramework_amd64.dll Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\System_Windows_Controls_Ribbon_gac_x86 Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\LocalService\Links Explorer.EXE File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent Explorer.EXE File opened for modification C:\Windows\INF\setupapi.app.log ie4uinit.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\system_data_dll_gac_x86 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\WindowsBase_gac_x86 Explorer.EXE File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SecStoreFile.ico Explorer.EXE File opened for modification C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe Explorer.EXE File opened for modification C:\Windows\assembly\pubpol4.dat Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_msvcr100_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\System_Windows_Controls_Ribbon_amd64.dll Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAutomationTypes_gac_x86 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100rus_x64 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\System_Windows_Controls_Ribbon_x86.dll Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\E8EBCC90469BFE03EA485673BA14799F\4.7.3062\UIAutomationClientsideProviders_gac_x86 Explorer.EXE File opened for modification C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100u_x64 Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2188 2488 WerFault.exe vgaqhvh.exe 2572 2144 WerFault.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
perfmon.exeExplorer.EXErunonce.exeExplorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz perfmon.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Explorer.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Explorer.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Explorer.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Explorer.EXE Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 perfmon.exe -
Enumerates system info in registry 2 TTPs 38 IoCs
Processes:
csrss.exechrome.exechrome.exedescription ioc process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
Processes:
ie4uinit.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" ie4uinit.exe -
Processes:
ie4uinit.exeregsvr32.exeregsvr32.exesystray.exeExplorer.EXEmctadmin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\Save_Session_History_On_Exit = "no" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\IETld\LowMic ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\16\IEFixedFontName = "Vani" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\26\IEFixedFontName = "NSimsun" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\37\IEPropFontName = "Khmer UI" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\39 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\Local Page = "C:\\Windows\\system32\\blank.htm" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Help_Menu_URLs ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Desktop\General regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Desktop\General regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\4 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\6\IEFixedFontName = "Courier New" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\9\IEPropFontName = "Times New Roman" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\10 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\38 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli" ie4uinit.exe Key created \Registry\User\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\5 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\8 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Segoe UI Symbol" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\35\IEPropFontName = "Estrangelo Edessa" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\BrowserEmulation ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Toolbar ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\13\IEPropFontName = "Shruti" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\23\IEFixedFontName = "GulimChe" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\26 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\Search Page = "http://go.microsoft.com/fwlink/?LinkId=54896" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\10\IEPropFontName = "Mangal" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\13 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\17\IEFixedFontName = "Tunga" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\32 ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\New Windows\PlaySound = "1" ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Document Windows\width = 00000080 ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Document Windows\y = 00000000 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\32\IEFixedFontName = "Segoe UI Symbol" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\36\IEFixedFontName = "Myanmar Text" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\37 ie4uinit.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\SQM\InstallDate = "1645813977" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\Cache_Update_Frequency = "Once_Per_Session" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Settings\Anchor Color Visited = "128,0,128" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\31 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\LowRegistry ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\3\IEPropFontName = "Times New Roman" ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\11 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\21 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\21\IEFixedFontName = "Microsoft Himalaya" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\26\IEPropFontName = "Simsun" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Plantagenet Cherokee" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Settings\Anchor Color = "0,0,255" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://go.microsoft.com/fwlink/p/?LinkId=255141" ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Document Windows\x = 00000080 ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main ie4uinit.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\15\IEPropFontName = "Vijaya" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\UseClearType = "no" ie4uinit.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = 909df91c762ad801 ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" mctadmin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\International\Scripts\24\IEPropFontName = "MS PGothic" ie4uinit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\Show_StatusBar = "yes" ie4uinit.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
Processes:
ie4uinit.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141" ie4uinit.exe -
Modifies data under HKEY_USERS 9 IoCs
Processes:
winlogon.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe -
Modifies registry class 64 IoCs
Processes:
unregmp2.exeunregmp2.exeExplorer.EXEregsvr32.exeExplorer.EXEregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867} unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.midi\OpenWithProgIds unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 000000000200000001000000ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.WTV\OpenWithProgIds unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/quicktime unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ts\OpenWithProgIds unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-midi unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.3g2 unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wmz\OpenWithProgIds unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001_Classes\Local Settings regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0 = ff000000f90000eeebbeeb000400070000004d0000003153505330f125b7ef471a10a5f102608c9eebac310000000a000000001f000000100000004d0061006e0061006700650020004100630063006f0075006e00740073000000000000004d00000031535053537def0c64fad111a2030000f81fedee3100000005000000001f0000000f0000007000610067006500410064006d0069006e005400610073006b00730000000000000000004d000000315350538727bf5ccf480842b90eee5e5d4202943100000019000000001f0000000f0000007500730065007200630070006c002e0064006c006c002c002d00310000000000000000000000000000000000 Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\1\0\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1001_CLASSES\Local Settings\MuiCache Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/3gpp2 unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}\ = "UnlockerShellExtension" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmv unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wax unregmp2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 0100000000000000ffffffff Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\MRUListEx = 00000000ffffffff Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf-plugin unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP.AudioCD\shell\Play unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\2\0\0\NodeSlot = "11" Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\1\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ts unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0 = 07010000010100eeebbef300040001000000510000003153505330f125b7ef471a10a5f102608c9eebac350000000a000000001f000000120000004300680061006e0067006500200061006e0020004100630063006f0075006e0074000000000000005100000031535053537def0c64fad111a2030000f81fedee3500000005000000001f0000001200000070006100670065004300680061006e0067006500430068006f0069006300650073000000000000004d000000315350538727bf5ccf480842b90eee5e5d4202943100000019000000001f0000000f0000007500730065007200630070006c002e0064006c006c002c002d00310000000000000000000000000000000000 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wav\OpenWithProgIds unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000010000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp4 unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/midi unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\OpenWithProgIds unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mov\OpenWithProgIds unregmp2.exe Set value (data) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\0\0\0\0 Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.WMD\OpenWithProgIds unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874385" Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2 unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" Explorer.EXE -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
reqbqonire.exesystray.exetaskmgr.exeperfmon.exepid process 1552 reqbqonire.exe 1552 reqbqonire.exe 1552 reqbqonire.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 548 systray.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 548 systray.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 548 systray.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 548 systray.exe 2012 taskmgr.exe 1704 perfmon.exe 1704 perfmon.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 548 systray.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 548 systray.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe 2012 taskmgr.exe 1704 perfmon.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
Explorer.EXEtaskmgr.exeExplorer.EXEpid process 1384 Explorer.EXE 2012 taskmgr.exe 2164 Explorer.EXE -
Suspicious behavior: LoadsDriver 6 IoCs
Processes:
Unlocker.exeUnlocker.exeUnlocker.exepid process 2120 Unlocker.exe 2120 Unlocker.exe 2828 Unlocker.exe 2828 Unlocker.exe 468 Unlocker.exe 468 Unlocker.exe -
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
reqbqonire.exesystray.exepid process 1552 reqbqonire.exe 1552 reqbqonire.exe 1552 reqbqonire.exe 1552 reqbqonire.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe 548 systray.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
reqbqonire.exesystray.exeExplorer.EXEtaskmgr.exeperfmon.exeWerFault.exeSetup.exeUnlocker.exeUnlocker.exedescription pid process Token: SeDebugPrivilege 1552 reqbqonire.exe Token: SeDebugPrivilege 548 systray.exe Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeDebugPrivilege 2012 taskmgr.exe Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeDebugPrivilege 1704 perfmon.exe Token: SeSystemProfilePrivilege 1704 perfmon.exe Token: SeCreateGlobalPrivilege 1704 perfmon.exe Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeDebugPrivilege 2188 WerFault.exe Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeTakeOwnershipPrivilege 2272 Setup.exe Token: SeTakeOwnershipPrivilege 2272 Setup.exe Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeShutdownPrivilege 1384 Explorer.EXE Token: SeDebugPrivilege 2120 Unlocker.exe Token: SeLoadDriverPrivilege 2120 Unlocker.exe Token: SeBackupPrivilege 2120 Unlocker.exe Token: SeTakeOwnershipPrivilege 2120 Unlocker.exe Token: SeDebugPrivilege 2828 Unlocker.exe Token: SeLoadDriverPrivilege 2828 Unlocker.exe Token: SeBackupPrivilege 2828 Unlocker.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Explorer.EXEtaskmgr.exepid process 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe 2012 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
Explorer.EXEWinMail.exeWinMail.exepid process 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 2616 WinMail.exe 3008 WinMail.exe -
Suspicious use of UnmapMainImage 38 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
INV21029.exereqbqonire.exeExplorer.EXEsystray.exetaskmgr.exechrome.exedescription pid process target process PID 1556 wrote to memory of 1316 1556 INV21029.exe reqbqonire.exe PID 1556 wrote to memory of 1316 1556 INV21029.exe reqbqonire.exe PID 1556 wrote to memory of 1316 1556 INV21029.exe reqbqonire.exe PID 1556 wrote to memory of 1316 1556 INV21029.exe reqbqonire.exe PID 1316 wrote to memory of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1316 wrote to memory of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1316 wrote to memory of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1316 wrote to memory of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1316 wrote to memory of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1316 wrote to memory of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1316 wrote to memory of 1552 1316 reqbqonire.exe reqbqonire.exe PID 1384 wrote to memory of 548 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 548 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 548 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 548 1384 Explorer.EXE systray.exe PID 548 wrote to memory of 840 548 systray.exe cmd.exe PID 548 wrote to memory of 840 548 systray.exe cmd.exe PID 548 wrote to memory of 840 548 systray.exe cmd.exe PID 548 wrote to memory of 840 548 systray.exe cmd.exe PID 1384 wrote to memory of 1516 1384 Explorer.EXE explorer.exe PID 1384 wrote to memory of 1516 1384 Explorer.EXE explorer.exe PID 1384 wrote to memory of 1516 1384 Explorer.EXE explorer.exe PID 1384 wrote to memory of 2012 1384 Explorer.EXE taskmgr.exe PID 1384 wrote to memory of 2012 1384 Explorer.EXE taskmgr.exe PID 1384 wrote to memory of 2012 1384 Explorer.EXE taskmgr.exe PID 2012 wrote to memory of 1704 2012 taskmgr.exe perfmon.exe PID 2012 wrote to memory of 1704 2012 taskmgr.exe perfmon.exe PID 2012 wrote to memory of 1704 2012 taskmgr.exe perfmon.exe PID 1384 wrote to memory of 956 1384 Explorer.EXE explorer.exe PID 1384 wrote to memory of 956 1384 Explorer.EXE explorer.exe PID 1384 wrote to memory of 956 1384 Explorer.EXE explorer.exe PID 1384 wrote to memory of 1748 1384 Explorer.EXE chrome.exe PID 1384 wrote to memory of 1748 1384 Explorer.EXE chrome.exe PID 1384 wrote to memory of 1748 1384 Explorer.EXE chrome.exe PID 1748 wrote to memory of 1452 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1452 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1452 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe PID 1748 wrote to memory of 1924 1748 chrome.exe chrome.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Deletes itself
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INV21029.exe"C:\Users\Admin\AppData\Local\Temp\INV21029.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeC:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeC:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef62a4f50,0x7fef62a4f60,0x7fef62a4f703⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1276 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1052 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1696 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2752 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2772 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3240 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3112 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3304 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3220 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3156 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4592 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5492 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5596 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3744 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5020 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3704 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3764 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3700 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4516 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1856 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1044,10518215230587322948,5324062942827604471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:83⤵
-
C:\Program Files (x86)\Bmrxh\vgaqhvh.exe"C:\Program Files (x86)\Bmrxh\vgaqhvh.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 1603⤵
- Loads dropped DLL
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Unlocker1.9.2.exe"C:\Users\Admin\Desktop\Unlocker1.9.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe"C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe" /aflt=babsst /babTrack="affID=122471" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\AB1115A5-BAB0-7891-B513-47C5E35F1725\Setup.exe"C:\Users\Admin\AppData\Local\Temp\AB1115A5-BAB0-7891-B513-47C5E35F1725\Setup.exe" -xprm="cat=delta" -expg=none /aflt=babsst /babTrack="affID=122471" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\AB1115~1\IEHelper.dll,UpdateProtectedModeCookieCache URI|http://babylon.com5⤵
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Internet Explorer\IELowutil.exe"C:\Program Files (x86)\Internet Explorer\IELowutil.exe" -embedding6⤵
-
C:\Users\Admin\AppData\Local\Temp\AB1115A5-BAB0-7891-B513-47C5E35F1725\Latest\Setup.exeC:\Users\Admin\AppData\Local\Temp\AB1115A5-BAB0-7891-B513-47C5E35F1725\Latest\Setup.exe -latest -trkInfo=[TType:5012_7] -xprm="cat=delta" -expg=none /aflt=babsst /babTrack="affID=122471" /srcExt=ss /instlRef=sst /S /mtb /mds /mhp /mnt5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Unlocker\UnlockerCOM.dll"3⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\Unlocker\UnlockerCOM.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
C:\Program Files\Unlocker\Unlocker.exe"C:\Program Files\Unlocker\Unlocker.exe" "C:\Users"2⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Unlocker\Unlocker.exe"C:\Program Files\Unlocker\Unlocker.exe" "C:\Users"2⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Unlocker\Unlocker.exe"C:\Program Files\Unlocker\Unlocker.exe" "C:\Users\Admin\Desktop\FormatMerge.dib"2⤵
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
C:\Windows\system32\net.exenet user test /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user test /add4⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe2⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE3⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll4⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Windows Mail\WinMail.exe"C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE4⤵
- Drops desktop.ini file(s)
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE5⤵
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI4⤵
- Enumerates connected drives
- Modifies registry class
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll4⤵
- Drops startup file
- Drops desktop.ini file(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install4⤵
-
C:\Windows\System32\ie4uinit.exe"C:\Windows\System32\ie4uinit.exe" -UserConfig4⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
-
C:\Windows\System32\ie4uinit.exeC:\Windows\System32\ie4uinit.exe -ClearIconCache5⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,365⤵
- Drops file in Windows directory
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m5⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /06⤵
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll4⤵
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI4⤵
- Enumerates connected drives
- Modifies registry class
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll4⤵
- Drops startup file
- Drops desktop.ini file(s)
- Modifies registry class
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install4⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level4⤵
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x144,0x148,0x14c,0x118,0x150,0x14016a890,0x14016a8a0,0x14016a8b05⤵
-
C:\Windows\System32\wer46t.exe"C:\Windows\System32\wer46t.exe"4⤵
-
C:\Windows\SysWOW64\runonce.exeC:\Windows\SysWOW64\runonce.exe /Run64324⤵
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices5⤵
-
C:\Program Files (x86)\Bmrxh\vgaqhvh.exe"C:\Program Files (x86)\Bmrxh\vgaqhvh.exe"5⤵
- Executes dropped EXE
-
C:\Program Files\Windows Sidebar\sidebar.exe"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun4⤵
- Adds Run key to start application
-
C:\Windows\System32\mctadmin.exe"C:\Windows\System32\mctadmin.exe"4⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\test\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\test\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\test\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef62a4f50,0x7fef62a4f60,0x7fef62a4f705⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1284 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1124 /prefetch:25⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1680 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3128 /prefetch:25⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3432 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3416 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,17635082688737395924,10170816228879891301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4112 /prefetch:85⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1601⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogsMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Program Files (x86)\Bmrxh\vgaqhvh.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Program Files (x86)\Bmrxh\vgaqhvh.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\1djuqculeikkmhtz2x2MD5
199f72b6103b1ad570f3a810d06c332a
SHA143b9341301394deec3c674cf98fc3c6cc629ee2b
SHA256a61bbd1659ba2338fe6e4df411d709834285b54991c403ba07bc9459af5320fc
SHA5120ce6be58193b0bcdccd003218597ce8f6bd0de35563c32d28c2e111903445f12ece5fa0a536dd2b79153b9c265c10a6ec17f8ef67b11edb95d155c0f502adeb5
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\truuummMD5
0a99632c69bc8d3fe6231d0a50bff785
SHA1ad875f4428f17d0474be5ee8667158bd14d10f22
SHA2560a11eae20268581b0ad9c67defaf1a4dc4bf183ede922eca10c5da698eec8078
SHA51293905216a40975163edfcc94cf3c55c40a27e4cf7143d028ef6c5caead6ceaaa1504bd4c5a05d043d61be3df08991ea7e1e8c98cdfafd9d8744ccacdc5d7de2f
-
C:\vcredist2010_x64.log-MSI_vc_red.msi.txtMD5
e741e1225a8dbcd66cd02c517914454e
SHA191ecb0e909c5f37c051f101d4dd1ca9342a4b914
SHA256d0c04bf550b3d4444919e85f6e17fcedd98f3f35039a7a2d6c859f571cab643c
SHA512070629d5da9a24436105197242814eeab28a63c7235da516f7816a23fe861d43c3e99b34ebc61c593dd431359223aaa4d76495c73eaf1d980275696092f21f37
-
C:\vcredist2010_x64.log.htmlMD5
2855d31e7da278b4f6fea56d393ed504
SHA175a6f225292e02ee63816b90dbab15415c7bece5
SHA2567266ee9026201cce1748e7775161074d316e962dc9817a2322f55e03258033d3
SHA51248756a9e27fa444e50334e13da91220d97858a1517f64349b8cb768049e2164b8cae7759456c2df53887841dc6a63e87390aff745a8133fe99600779fdbc245a
-
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.logMD5
d0cbef244cd62659778b00ac1935998f
SHA1570915981bf13411eab826c340d931ffbca7c20e
SHA256d73e1f873bde275ec4fbc9efbc4f3483bb55506a7b48b0d0479757a862adc5e9
SHA5123a9a13723dc901def2014bb5d2dffaef3d32a29cb3645f5d9f751bd76b72356a86fdd5fe1616e2cb7cb029e343eb6c30b80e73d2f1c35a327e5a12e50ca0a44c
-
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.logMD5
28e15c692625240eff43a847d404e39d
SHA166933132b00e5f3bdd6f40573ebbe5aea1e18097
SHA2560a58b0fb56b01514490ddf2d829882799adf00f89cd0dafce7952e52bfdc64d3
SHA51220e2a47eac1b5f387f2c8b53d0948b5ca173851a4cb2abaa6634e32615b727fe406a0167720017b677396a752cca968eb6c9bb7dd5aee704296a5fdeb5bc3892
-
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.logMD5
57a864b73d56bd758af95a3ccaa1f32e
SHA1d4b5b20726e557ecb68fa8c063300b07b6af2d12
SHA256d12ed56e506371fd3f536f529f9c496c1ba9ae65e21efa63b65ca55d21daaff2
SHA5125412c13f752b27d0fa8f1134a72083ffc36b7050ade3e3a7b813871619658d42c59888d8926fd502ea2e8a4163e0d6d5fb33e9e75a0223d4f7a36c3aab869cfa
-
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.logMD5
1da08be1c2286103f7e338e2548ca749
SHA112d86c5b8573a6f555ab1fc1b79a9eda1a4fa458
SHA256d737241ef7e39978641832dcc1bbfbf73e0e51ebe4c93c75fc13a2f15e1ec660
SHA512de67d5871d65293525fcbed4c5b2b6e33748840873f31e8b2921833012e73dfe47c4b9f5957e4f942f25607f4023eb21bcc90cb70c8ab4eb8df34244c8e9a213
-
C:\vcredist2019_x64_001_vcRuntimeMinimum_x64.logMD5
79045f3bb86aa3ecf838aa9b0de3368d
SHA19f7584751aeac0689064a1d947ccf120ff19e9a0
SHA25658c7032ddb8beb99a039ce6a05f17bd6fd6215916d853351322c6540c810e6d5
SHA512052c97438c1e5a0a29209d03cb6f7e9ca3690d01cb3a3dcfc421153f33b7242a95aa47531e2e79e81d606435eed5b96b21d700a6a97045c8c71753e9534da5ff
-
C:\vcredist2019_x64_002_vcRuntimeAdditional_x64.logMD5
c9de5d72b007bf32448b6ea50ff15ae5
SHA11e41b54869f19a255a2201ed85cffa6025b2d435
SHA256933e20285c0a527038395c168049e62aa5eebd7c88ce16f729c9a606341a5177
SHA512374a12e4df4c36784d9c08595cae89121c20901f023dd0d510007876111e574b9309d0ee53c1b216123cc3437380c4f5f4d11284dbdb79cdf2ca7d1605d0c3eb
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_1748_JYMQEHJWHNMVPGPRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files (x86)\Bmrxh\vgaqhvh.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
\Program Files (x86)\Bmrxh\vgaqhvh.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
\Program Files (x86)\Bmrxh\vgaqhvh.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
\Program Files (x86)\Bmrxh\vgaqhvh.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
memory/548-76-0x0000000002000000-0x0000000002303000-memory.dmpFilesize
3.0MB
-
memory/548-78-0x0000000000540000-0x00000000005D0000-memory.dmpFilesize
576KB
-
memory/548-75-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/548-74-0x0000000000210000-0x0000000000215000-memory.dmpFilesize
20KB
-
memory/1096-111-0x0000000000190000-0x0000000000192000-memory.dmpFilesize
8KB
-
memory/1384-69-0x0000000005090000-0x00000000051D4000-memory.dmpFilesize
1.3MB
-
memory/1384-79-0x0000000004F10000-0x0000000004FC1000-memory.dmpFilesize
708KB
-
memory/1384-73-0x0000000006CE0000-0x0000000006E85000-memory.dmpFilesize
1.6MB
-
memory/1460-121-0x0000000072401000-0x0000000072403000-memory.dmpFilesize
8KB
-
memory/1504-124-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/1516-77-0x000007FEFC2D1000-0x000007FEFC2D3000-memory.dmpFilesize
8KB
-
memory/1552-72-0x00000000003A0000-0x00000000003B1000-memory.dmpFilesize
68KB
-
memory/1552-71-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1552-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1552-65-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1552-68-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/1552-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1552-67-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1556-54-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1704-91-0x0000000001C60000-0x0000000001C61000-memory.dmpFilesize
4KB
-
memory/2164-136-0x0000000005210000-0x0000000005351000-memory.dmpFilesize
1.3MB
-
memory/2164-153-0x0000000001BC0000-0x0000000001BC1000-memory.dmpFilesize
4KB
-
memory/2188-105-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/2492-110-0x00000000009E0000-0x00000000009E2000-memory.dmpFilesize
8KB
-
memory/2572-152-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2616-130-0x00000000002B0000-0x00000000002D0000-memory.dmpFilesize
128KB
-
memory/2616-134-0x0000000002360000-0x0000000002362000-memory.dmpFilesize
8KB
-
memory/2616-129-0x000007FEF4001000-0x000007FEF4003000-memory.dmpFilesize
8KB
-
memory/3008-141-0x000007FEF3F81000-0x000007FEF3F83000-memory.dmpFilesize
8KB
-
memory/3008-142-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB