Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 16:34
Static task
static1
Behavioral task
behavioral1
Sample
04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe
-
Size
273KB
-
MD5
aad7e430001c57547416b6dcfe3b29a4
-
SHA1
5b38dfecfc0e7c7cecf542e8191166333e74c548
-
SHA256
04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991
-
SHA512
fc8d7cc0ac1eca9071eda613649bc3a0746eabf319870af930e17876001ae103acc5b57b24e7c3fc6aa8f84aaa7ba7b4c7475b68dd48c452990629746fa47fe7
-
SSDEEP
6144:mY94NIKotWI35Deg5NEezflAGrEyueeQHEj69Y8P0jI:N9OSX7HflXIME6xPB
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 832 rinst.exe 4836 dichvum4gvn1.exe 3280 dichvum4gvn1.exe 1408 bpk.exe 3888 dichvum4gvn1.exe 2860 dichvum4gvn1.exe 3496 dichvum4gvn1.exe 3580 dichvum4gvn1.exe 4608 dichvum4gvn1.exe 4596 dichvum4gvn1.exe 3736 dichvum4gvn1.exe 1280 dichvum4gvn1.exe 4312 dichvum4gvn1.exe 5076 dichvum4gvn1.exe 4356 dichvum4gvn1.exe 3464 dichvum4gvn1.exe 1784 dichvum4gvn1.exe 4636 dichvum4gvn1.exe 4896 dichvum4gvn1.exe 3588 dichvum4gvn1.exe 2836 dichvum4gvn1.exe 5072 dichvum4gvn1.exe 4156 dichvum4gvn1.exe 4980 dichvum4gvn1.exe 4424 dichvum4gvn1.exe 4868 dichvum4gvn1.exe 1728 dichvum4gvn1.exe 1464 dichvum4gvn1.exe 2036 dichvum4gvn1.exe 4012 dichvum4gvn1.exe 3040 dichvum4gvn1.exe 2052 dichvum4gvn1.exe 2968 dichvum4gvn1.exe 4892 dichvum4gvn1.exe 212 dichvum4gvn1.exe 224 dichvum4gvn1.exe 3480 dichvum4gvn1.exe 3408 dichvum4gvn1.exe 2484 dichvum4gvn1.exe 3908 dichvum4gvn1.exe 1360 dichvum4gvn1.exe 1380 dichvum4gvn1.exe 3344 dichvum4gvn1.exe 3136 dichvum4gvn1.exe 1188 dichvum4gvn1.exe 4744 dichvum4gvn1.exe 5016 dichvum4gvn1.exe 5100 dichvum4gvn1.exe 3048 dichvum4gvn1.exe 2284 dichvum4gvn1.exe 1296 dichvum4gvn1.exe 2496 dichvum4gvn1.exe 4800 dichvum4gvn1.exe 3880 dichvum4gvn1.exe 3668 dichvum4gvn1.exe 3700 dichvum4gvn1.exe 3996 dichvum4gvn1.exe 3720 dichvum4gvn1.exe 1420 dichvum4gvn1.exe 4152 dichvum4gvn1.exe 4804 dichvum4gvn1.exe 2508 dichvum4gvn1.exe 2004 dichvum4gvn1.exe 1272 dichvum4gvn1.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation rinst.exe -
Loads dropped DLL 4 IoCs
pid Process 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 4140 04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dichvum4gvn1 = "C:\\Windows\\system32\\dichvum4gvn1.exe" Process not Found -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "PK IE Plugin" bpk.exe -
Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Unlock = "WLEUnlock" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Startup = "WLEStartup" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Unlock = "WLEUnlock" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Shutdown = "WLEShutdown" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Shutdown = "WLEShutdown" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logon = "WLELogon" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StopScreenSaver = "WLEStopScreenSaver" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Asynchronous = "0" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StopScreenSaver = "WLEStopScreenSaver" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StopScreenSaver = "WLEStopScreenSaver" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 dichvum4gvn1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Asynchronous = "0" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StopScreenSaver = "WLEStopScreenSaver" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StopScreenSaver = "WLEStopScreenSaver" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\DllName = "dichvum4gvn1.dll" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Shutdown = "WLEShutdown" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StartScreenSaver = "WLEStartScreenSaver" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Startup = "WLEStartup" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\DllName = "dichvum4gvn1.dll" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Impersonate = "0" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logon = "WLELogon" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\DllName = "dichvum4gvn1.dll" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\DllName = "dichvum4gvn1.dll" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logon = "WLELogon" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Startup = "WLEStartup" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StopScreenSaver = "WLEStopScreenSaver" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\DllName = "dichvum4gvn1.dll" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logon = "WLELogon" dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Shutdown = "WLEShutdown" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Unlock = "WLEUnlock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Lock = "WLELock" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Unlock = "WLEUnlock" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1 dichvum4gvn1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Asynchronous = "0" Process not Found Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Impersonate = "0" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Lock = "WLELock" dichvum4gvn1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Asynchronous = "0" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logon = "WLELogon" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Logoff = "WLELogoff" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Unlock = "WLEUnlock" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\StartScreenSaver = "WLEStartScreenSaver" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Lock = "WLELock" dichvum4gvn1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Impersonate = "0" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Unlock = "WLEUnlock" dichvum4gvn1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\Asynchronous = "0" dichvum4gvn1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dichvum4gvn1\DllName = "dichvum4gvn1.dll" dichvum4gvn1.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe File created C:\Windows\SysWOW64\dichvum4gvn1.exe Process not Found File created C:\Windows\SysWOW64\dichvum4gvn1.exe dichvum4gvn1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 16904 15652 Process not Found 2111 40748 40540 Process not Found 2122 -
Checks SCSI registry key(s) 3 TTPs 24 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID Process not Found -
Enumerates system info in registry 2 TTPs 12 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Process not Found -
Modifies registry class 46 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer\ = "PK.IE.1" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID\ = "PK.IE.1" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID\ = "PK.IE" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\ = "BPK IE Plugin Type Library" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\bpkwb.dll" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\Version = "1.0" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ = "IE Plugin Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\VersionIndependentProgID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\CLSID bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\Programmable bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\FLAGS\ = "0" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1\ = "IE Plugin Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ProxyStubClsid32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\ = "IViewSource" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\ProgID bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ThreadingModel = "Apartment" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE.1 bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\ = "IE Class" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A} bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\0\win32 bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E1B2878-88FF-11D3-8D96-D7ACAC95951A}\TypeLib bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CLSID\ = "{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PK.IE\CurVer bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\InprocServer32\ = "C:\\Windows\\SysWow64\\bpkwb.dll" bpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1E1B2879-88FF-11D3-8D96-D7ACAC95951A}\TypeLib\ = "{1E1B286C-88FF-11D3-8D96-D7ACAC95951A}" bpk.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 39324 Process not Found 2544 Process not Found 2820 Process not Found 2924 Process not Found 2860 Process not Found 4596 Process not Found 944 Process not Found 5076 Process not Found 4744 Process not Found 3136 Process not Found 2484 Process not Found 212 Process not Found 2968 Process not Found 4424 Process not Found 1728 Process not Found 5100 Process not Found 3140 Process not Found 2552 Process not Found 3808 Process not Found 23624 Process not Found 23844 Process not Found 23832 Process not Found 2716 Process not Found 2800 Process not Found 23932 Process not Found 24040 Process not Found 24068 Process not Found 24052 Process not Found 24112 Process not Found 24332 Process not Found 2144 Process not Found 24368 Process not Found 24316 Process not Found 5024 Process not Found 24416 Process not Found 1076 Process not Found 24608 Process not Found 24552 Process not Found 3084 Process not Found 4840 Process not Found 24976 Process not Found 25032 Process not Found 24956 Process not Found 25060 Process not Found 25044 Process not Found 25088 Process not Found 5040 Process not Found 25452 Process not Found 25392 Process not Found 3748 Process not Found 25500 Process not Found 25544 Process not Found 1152 Process not Found 4172 Process not Found 3896 Process not Found 5204 Process not Found 25844 Process not Found 25964 Process not Found 5268 Process not Found 25980 Process not Found 26040 Process not Found 5316 Process not Found 5372 Process not Found 26132 Process not Found -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeCreateGlobalPrivilege 15652 Process not Found Token: SeChangeNotifyPrivilege 15652 Process not Found Token: 33 15652 Process not Found Token: SeIncBasePriorityPrivilege 15652 Process not Found Token: SeCreateGlobalPrivilege 64 Process not Found Token: SeChangeNotifyPrivilege 64 Process not Found Token: 33 64 Process not Found Token: SeIncBasePriorityPrivilege 64 Process not Found Token: SeCreateGlobalPrivilege 16392 Process not Found Token: SeChangeNotifyPrivilege 16392 Process not Found Token: 33 16392 Process not Found Token: SeIncBasePriorityPrivilege 16392 Process not Found Token: SeCreateGlobalPrivilege 39992 Process not Found Token: SeChangeNotifyPrivilege 39992 Process not Found Token: 33 39992 Process not Found Token: SeIncBasePriorityPrivilege 39992 Process not Found Token: SeCreateGlobalPrivilege 40124 Process not Found Token: SeChangeNotifyPrivilege 40124 Process not Found Token: 33 40124 Process not Found Token: SeIncBasePriorityPrivilege 40124 Process not Found Token: SeCreateGlobalPrivilege 40288 Process not Found Token: SeChangeNotifyPrivilege 40288 Process not Found Token: 33 40288 Process not Found Token: SeIncBasePriorityPrivilege 40288 Process not Found Token: SeCreateGlobalPrivilege 40404 Process not Found Token: SeChangeNotifyPrivilege 40404 Process not Found Token: 33 40404 Process not Found Token: SeIncBasePriorityPrivilege 40404 Process not Found Token: SeCreateGlobalPrivilege 40540 Process not Found Token: SeChangeNotifyPrivilege 40540 Process not Found Token: 33 40540 Process not Found Token: SeIncBasePriorityPrivilege 40540 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1408 bpk.exe 1408 bpk.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe 1408 bpk.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 832 4140 04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe 88 PID 4140 wrote to memory of 832 4140 04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe 88 PID 4140 wrote to memory of 832 4140 04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe 88 PID 832 wrote to memory of 4836 832 rinst.exe 90 PID 832 wrote to memory of 4836 832 rinst.exe 90 PID 832 wrote to memory of 4836 832 rinst.exe 90 PID 4836 wrote to memory of 3280 4836 dichvum4gvn1.exe 92 PID 4836 wrote to memory of 3280 4836 dichvum4gvn1.exe 92 PID 4836 wrote to memory of 3280 4836 dichvum4gvn1.exe 92 PID 832 wrote to memory of 1408 832 rinst.exe 91 PID 832 wrote to memory of 1408 832 rinst.exe 91 PID 832 wrote to memory of 1408 832 rinst.exe 91 PID 3280 wrote to memory of 3888 3280 dichvum4gvn1.exe 93 PID 3280 wrote to memory of 3888 3280 dichvum4gvn1.exe 93 PID 3280 wrote to memory of 3888 3280 dichvum4gvn1.exe 93 PID 3888 wrote to memory of 2860 3888 dichvum4gvn1.exe 94 PID 3888 wrote to memory of 2860 3888 dichvum4gvn1.exe 94 PID 3888 wrote to memory of 2860 3888 dichvum4gvn1.exe 94 PID 2860 wrote to memory of 3496 2860 dichvum4gvn1.exe 95 PID 2860 wrote to memory of 3496 2860 dichvum4gvn1.exe 95 PID 2860 wrote to memory of 3496 2860 dichvum4gvn1.exe 95 PID 3496 wrote to memory of 3580 3496 dichvum4gvn1.exe 96 PID 3496 wrote to memory of 3580 3496 dichvum4gvn1.exe 96 PID 3496 wrote to memory of 3580 3496 dichvum4gvn1.exe 96 PID 3580 wrote to memory of 4608 3580 dichvum4gvn1.exe 97 PID 3580 wrote to memory of 4608 3580 dichvum4gvn1.exe 97 PID 3580 wrote to memory of 4608 3580 dichvum4gvn1.exe 97 PID 4608 wrote to memory of 4596 4608 dichvum4gvn1.exe 98 PID 4608 wrote to memory of 4596 4608 dichvum4gvn1.exe 98 PID 4608 wrote to memory of 4596 4608 dichvum4gvn1.exe 98 PID 4596 wrote to memory of 3736 4596 dichvum4gvn1.exe 99 PID 4596 wrote to memory of 3736 4596 dichvum4gvn1.exe 99 PID 4596 wrote to memory of 3736 4596 dichvum4gvn1.exe 99 PID 3736 wrote to memory of 1280 3736 dichvum4gvn1.exe 100 PID 3736 wrote to memory of 1280 3736 dichvum4gvn1.exe 100 PID 3736 wrote to memory of 1280 3736 dichvum4gvn1.exe 100 PID 1280 wrote to memory of 4312 1280 dichvum4gvn1.exe 102 PID 1280 wrote to memory of 4312 1280 dichvum4gvn1.exe 102 PID 1280 wrote to memory of 4312 1280 dichvum4gvn1.exe 102 PID 4312 wrote to memory of 5076 4312 dichvum4gvn1.exe 101 PID 4312 wrote to memory of 5076 4312 dichvum4gvn1.exe 101 PID 4312 wrote to memory of 5076 4312 dichvum4gvn1.exe 101 PID 5076 wrote to memory of 4356 5076 dichvum4gvn1.exe 103 PID 5076 wrote to memory of 4356 5076 dichvum4gvn1.exe 103 PID 5076 wrote to memory of 4356 5076 dichvum4gvn1.exe 103 PID 4356 wrote to memory of 3464 4356 dichvum4gvn1.exe 104 PID 4356 wrote to memory of 3464 4356 dichvum4gvn1.exe 104 PID 4356 wrote to memory of 3464 4356 dichvum4gvn1.exe 104 PID 3464 wrote to memory of 1784 3464 dichvum4gvn1.exe 105 PID 3464 wrote to memory of 1784 3464 dichvum4gvn1.exe 105 PID 3464 wrote to memory of 1784 3464 dichvum4gvn1.exe 105 PID 1784 wrote to memory of 4636 1784 dichvum4gvn1.exe 106 PID 1784 wrote to memory of 4636 1784 dichvum4gvn1.exe 106 PID 1784 wrote to memory of 4636 1784 dichvum4gvn1.exe 106 PID 4636 wrote to memory of 4896 4636 dichvum4gvn1.exe 107 PID 4636 wrote to memory of 4896 4636 dichvum4gvn1.exe 107 PID 4636 wrote to memory of 4896 4636 dichvum4gvn1.exe 107 PID 4896 wrote to memory of 3588 4896 dichvum4gvn1.exe 108 PID 4896 wrote to memory of 3588 4896 dichvum4gvn1.exe 108 PID 4896 wrote to memory of 3588 4896 dichvum4gvn1.exe 108 PID 3588 wrote to memory of 2836 3588 dichvum4gvn1.exe 109 PID 3588 wrote to memory of 2836 3588 dichvum4gvn1.exe 109 PID 3588 wrote to memory of 2836 3588 dichvum4gvn1.exe 109 PID 2836 wrote to memory of 5072 2836 dichvum4gvn1.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe"C:\Users\Admin\AppData\Local\Temp\04e0d3b87f41a71512400ca6df0875a22a6672dc4fb57f42d990fc248942c991.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\dichvum4gvn1.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\dichvum4gvn1.exe"3⤵
- Executes dropped EXE
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe7⤵
- Executes dropped EXE
- Modifies WinLogon
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\bpk.exeC:\Windows\system32\bpk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe9⤵
- Executes dropped EXE
PID:5072 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe10⤵
- Executes dropped EXE
PID:4156 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe11⤵
- Executes dropped EXE
PID:4980 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe12⤵
- Executes dropped EXE
PID:4424 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe13⤵
- Executes dropped EXE
PID:4868 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe14⤵
- Executes dropped EXE
PID:1728 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe15⤵
- Executes dropped EXE
PID:1464 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe16⤵
- Executes dropped EXE
PID:2036 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe17⤵
- Executes dropped EXE
PID:4012 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe18⤵
- Executes dropped EXE
PID:3040 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe19⤵
- Executes dropped EXE
PID:2052 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe20⤵
- Executes dropped EXE
PID:2968 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe21⤵
- Executes dropped EXE
PID:4892 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe22⤵
- Executes dropped EXE
PID:212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe1⤵
- Executes dropped EXE
PID:224 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe2⤵
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe3⤵
- Executes dropped EXE
PID:3408 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe4⤵
- Executes dropped EXE
PID:2484 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe5⤵
- Executes dropped EXE
PID:3908 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe6⤵
- Executes dropped EXE
PID:1360 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe7⤵
- Executes dropped EXE
PID:1380 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe8⤵
- Executes dropped EXE
PID:3344 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe9⤵
- Executes dropped EXE
PID:3136 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe10⤵
- Executes dropped EXE
- Modifies WinLogon
PID:1188 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe11⤵
- Executes dropped EXE
PID:4744 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe12⤵
- Executes dropped EXE
PID:5016 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe13⤵
- Executes dropped EXE
PID:5100 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe14⤵
- Executes dropped EXE
PID:3048 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe15⤵
- Executes dropped EXE
PID:2284 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe16⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe17⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe18⤵
- Executes dropped EXE
PID:4800 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe19⤵
- Executes dropped EXE
PID:3880 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe20⤵
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe21⤵
- Executes dropped EXE
PID:3700 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe22⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3996 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe23⤵
- Executes dropped EXE
PID:3720 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe24⤵
- Executes dropped EXE
PID:1420 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe25⤵
- Executes dropped EXE
PID:4152 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe26⤵
- Executes dropped EXE
PID:4804 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe27⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2508 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe28⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2004 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe29⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe30⤵PID:5152
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe31⤵PID:5180
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe32⤵PID:5200
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe33⤵PID:5216
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe34⤵PID:5232
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe35⤵PID:5248
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe36⤵PID:5264
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe37⤵PID:5280
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe38⤵PID:5296
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe39⤵PID:5312
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe40⤵PID:5324
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe41⤵PID:5344
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe42⤵PID:5360
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe43⤵PID:5376
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe44⤵PID:5392
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe45⤵PID:5408
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe46⤵
- Adds Run key to start application
PID:5424 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe47⤵PID:5440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe1⤵PID:5452
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe2⤵PID:5480
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe3⤵PID:5512
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe4⤵PID:5548
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe5⤵PID:5564
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe6⤵PID:5580
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe7⤵PID:5596
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe8⤵PID:5608
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe9⤵PID:5628
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe10⤵PID:5644
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe11⤵PID:5660
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe12⤵PID:5676
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe13⤵PID:5692
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe14⤵PID:5708
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe15⤵PID:5724
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe16⤵PID:5740
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe17⤵PID:5756
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe18⤵PID:5772
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe19⤵PID:5788
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe20⤵PID:5800
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe21⤵PID:5816
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe22⤵PID:5836
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe23⤵PID:5852
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe24⤵PID:5868
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe25⤵PID:5884
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe26⤵PID:5900
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe27⤵PID:5916
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe28⤵PID:5932
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe29⤵PID:5948
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe30⤵PID:5964
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe31⤵PID:5980
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe32⤵PID:5996
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe33⤵PID:6008
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe34⤵PID:6028
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe35⤵PID:6044
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe36⤵PID:6056
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe37⤵PID:6076
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe38⤵PID:6092
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe39⤵PID:6108
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe40⤵PID:6120
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe41⤵PID:6140
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe42⤵PID:5492
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe43⤵PID:6156
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe44⤵PID:6168
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe45⤵PID:6184
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe46⤵PID:6204
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe47⤵PID:6220
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe48⤵PID:6240
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe49⤵PID:6260
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe50⤵
- Drops file in System32 directory
PID:6284 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe51⤵
- Modifies WinLogon
PID:6300 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe52⤵PID:6312
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe53⤵PID:6328
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe54⤵PID:6352
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe55⤵PID:6364
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe56⤵PID:6396
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe57⤵PID:6412
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe58⤵PID:6432
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe59⤵PID:6452
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe60⤵PID:6472
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe61⤵
- Modifies WinLogon
PID:6492 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe62⤵PID:6516
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe63⤵PID:6544
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe64⤵
- Adds Run key to start application
PID:6560 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe65⤵PID:6576
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe66⤵PID:6604
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe67⤵PID:6640
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe68⤵PID:6652
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe69⤵PID:6676
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe70⤵PID:6692
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe71⤵PID:6712
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe72⤵PID:6728
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe73⤵PID:6740
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe74⤵PID:6756
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe75⤵PID:6772
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe76⤵PID:6792
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe77⤵
- Drops file in System32 directory
PID:6804 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe78⤵PID:6820
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe79⤵PID:6844
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe80⤵PID:6856
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe81⤵PID:6872
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe82⤵PID:6892
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe83⤵PID:6908
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe84⤵PID:6924
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe85⤵PID:6936
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe86⤵
- Adds Run key to start application
PID:6956 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe87⤵
- Modifies WinLogon
- Drops file in System32 directory
PID:6972 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe88⤵PID:6984
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe89⤵PID:7004
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe90⤵PID:7020
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe91⤵PID:7036
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe92⤵PID:7052
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe93⤵PID:7068
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe94⤵PID:7088
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe95⤵PID:7104
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe96⤵PID:7120
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe97⤵PID:7136
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe98⤵PID:7148
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe99⤵PID:2148
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe100⤵
- Drops file in System32 directory
PID:7184 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe101⤵PID:7200
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe102⤵PID:7216
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe103⤵PID:7232
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe104⤵
- Modifies WinLogon
PID:7248 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe105⤵PID:7264
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe106⤵PID:7280
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe107⤵PID:7296
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe108⤵PID:7312
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe109⤵PID:7328
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe110⤵PID:7344
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe111⤵
- Adds Run key to start application
PID:7360 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe112⤵PID:7376
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe113⤵PID:7392
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe114⤵PID:7404
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe115⤵PID:7424
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe116⤵PID:7440
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe117⤵PID:7456
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe118⤵
- Drops file in System32 directory
PID:7472 -
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe119⤵PID:7488
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe120⤵PID:7504
-
C:\Windows\SysWOW64\dichvum4gvn1.exeC:\Windows\system32\dichvum4gvn1.exe121⤵PID:7520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-