xtremerat | 5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Size

515KB
MD5

066dd80d4b026fb182eb1fab64971ee1
SHA1

f97b97883304ee4fbeeefd4d247c13b8e0a02516
SHA256

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1
SHA512

854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065
SSDEEP

12288:iBDNRR3byG8UrHl+WGmEsdh+DCkbFX93yRotNNpbcqrthv5xq:iBDNRR3byGtFBGZJCkbFXIyNpbcqt

Score

10^/10

xtremerat persistence rat spyware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Adds policy Run key to start application 2 TTPs 56 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exewinregedigr.exewinregedigr.exewinregedigr.exeexplorer.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exesvchost.exewinregedigr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe

Executes dropped EXE 26 IoCs

Processes:

winregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe

pid	process
1752	winregedigr.exe
1640	winregedigr.exe
1216	winregedigr.exe
1108	winregedigr.exe
1284	winregedigr.exe
1504	winregedigr.exe
792	winregedigr.exe
748	winregedigr.exe
1428	winregedigr.exe
1812	winregedigr.exe
1684	winregedigr.exe
1692	winregedigr.exe
852	winregedigr.exe
792	winregedigr.exe
2004	winregedigr.exe
948	winregedigr.exe
1580	winregedigr.exe
1180	winregedigr.exe
2248	winregedigr.exe
2288	winregedigr.exe
2480	winregedigr.exe
2524	winregedigr.exe
2864	winregedigr.exe
2892	winregedigr.exe
1216	winregedigr.exe
1564	winregedigr.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

1708 explorer.exe

pid	process
1708	explorer.exe

Loads dropped DLL 12 IoCs

Processes:

svchost.exe

pid	process
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe
932	svchost.exe

Adds Run key to start application 2 TTPs 60 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exesvchost.exewinregedigr.exewinregedigr.exewinregedigr.exeexplorer.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe

Suspicious use of SetThreadContext 14 IoCs

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe

description	pid	process	target process
PID 1324 set thread context of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1752 set thread context of 1640	1752	winregedigr.exe	winregedigr.exe
PID 1216 set thread context of 1108	1216	winregedigr.exe	winregedigr.exe
PID 1284 set thread context of 1504	1284	winregedigr.exe	winregedigr.exe
PID 792 set thread context of 748	792	winregedigr.exe	winregedigr.exe
PID 1428 set thread context of 1812	1428	winregedigr.exe	winregedigr.exe
PID 1684 set thread context of 1692	1684	winregedigr.exe	winregedigr.exe
PID 852 set thread context of 792	852	winregedigr.exe	winregedigr.exe
PID 1580 set thread context of 1180	1580	winregedigr.exe	winregedigr.exe
PID 2248 set thread context of 2288	2248	winregedigr.exe	winregedigr.exe
PID 2480 set thread context of 2524	2480	winregedigr.exe	winregedigr.exe
PID 2288 set thread context of 2424	2288	winregedigr.exe	explorer.exe
PID 2864 set thread context of 2892	2864	winregedigr.exe	winregedigr.exe
PID 1216 set thread context of 1564	1216	winregedigr.exe	winregedigr.exe

Drops file in Windows directory 37 IoCs

Processes:

winregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe

description	ioc	process
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File created	C:\Windows\InstallDir\winregedigr.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
File opened for modification	C:\Windows\InstallDir\	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

explorer.exe

pid process

2424 explorer.exe
Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

explorer.exe

pid process

2424 explorer.exe

pid	process
2424	explorer.exe

pid	process
2424	explorer.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

pid	process
1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
1752	winregedigr.exe
1216	winregedigr.exe
1284	winregedigr.exe
792	winregedigr.exe
1428	winregedigr.exe
1684	winregedigr.exe
852	winregedigr.exe
1580	winregedigr.exe
1692	winregedigr.exe
2248	winregedigr.exe
2480	winregedigr.exe
2864	winregedigr.exe
948	winregedigr.exe
2424	explorer.exe
1216	winregedigr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe

description	pid	process	target process
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1324 wrote to memory of 968	1324	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 968 wrote to memory of 932	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 968 wrote to memory of 932	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 968 wrote to memory of 932	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 968 wrote to memory of 932	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 968 wrote to memory of 932	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 968 wrote to memory of 1532	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1532	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1532	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1532	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 888	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 888	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 888	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 888	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1708	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1708	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1708	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1708	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1708	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1968	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1968	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1968	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1968	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 896	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 896	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 896	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 896	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 764	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 764	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 764	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 764	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 304	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 304	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 304	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 304	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1392	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1392	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1392	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1392	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1288	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1288	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1288	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1288	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 972	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 972	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 972	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 972	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1564	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1564	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1564	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1564	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 968 wrote to memory of 1096	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe
PID 968 wrote to memory of 1096	968	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
"C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324

C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
"C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe"
2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
PID:932

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1640

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1740

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1812

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1404

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1248

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2004

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1604

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:620

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:860

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1948

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2044

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1216

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:952

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:924

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2036

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1616

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1776

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2032

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1872

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1576

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1284

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:376

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1864

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1532

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1348

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:680

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1416

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1448

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1364

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:792

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:748

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:996

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:480

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:524

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1584

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1340

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1512

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1300

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1428

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1812

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1332

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1020

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2024

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1180

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:656

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1540

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1336

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1684

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1692

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1924

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1096

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1060

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:556

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1736

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:764

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1364

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1484

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1008

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:968

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1632

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1740

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1404

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1248

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:620

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1528

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1748

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:860

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1948

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1544

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:888

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:820

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1820

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:952

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:376

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1532

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1976

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:656

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:856

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1796

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1580

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
7⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:2288

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
8⤵
PID:2416

C:\Windows\SysWOW64\explorer.exe
explorer.exe
8⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
PID:2424

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:852

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:792

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1952

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:944

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:276

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1284

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1324

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1572

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1208

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1392

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:976

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2008

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1648

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1108

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:756

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2024

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2072

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2080

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
PID:2004

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:948

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:572

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1536

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:816

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1932

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:852

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1348

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1608

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1628

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1540

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:676

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:884

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2096

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2188

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2196

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2280

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2272

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2376

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2384

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2464

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2472

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2632

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2640

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2708

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2716

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2744

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2752

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2816

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2808

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2852

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2844

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1216

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
7⤵
- Executes dropped EXE
PID:1564

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1580

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1180

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1788

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:1812

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1144

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2056

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2064

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2112

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2204

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2212

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2352

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2360

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2392

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2400

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2516

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2508

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2652

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2660

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2760

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2768

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2776

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2784

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2968

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2976

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2480

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:2524

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2680

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2792

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2800

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2836

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:2828

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
PID:3008

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2864

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Executes dropped EXE
PID:2892

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1532

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:888

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Deletes itself
PID:1708

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:896

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1968

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:304

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1392

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1288

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1564

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:972

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1096

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1076

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:748

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:556

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1736

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:852

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:676

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2008

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1760

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1152

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1788

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1976

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1816

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1972

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:840

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1768

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1444

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:944

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:572

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
3⤵
PID:1536

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.dat
Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.svr
Filesize
346KB

MD5
b6d63330959896290103db9786bd33d6

SHA1
b2558e1b4c6d9e012801a6e6564cf44fa16d6d14

SHA256
38d68f85dd0d99524efb7b537ce8fc5c7494126da1455a8d700cec51ef021c24

SHA512
54cd768f2df8e7e570a95073e1727465c6c22945334e33b835608b8933ef81d59eb33b3b5b434dde5c8b2f25130b417a076916fa4b7fcd9c33a133681cecc9b2

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
memory/748-176-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/748-169-0x0000000000C88814-mapping.dmp

Download
memory/748-199-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/792-244-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/792-274-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/792-238-0x0000000000C88814-mapping.dmp

Download
memory/792-155-0x0000000000000000-mapping.dmp

Download
memory/852-224-0x0000000000000000-mapping.dmp

Download
memory/932-74-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/932-73-0x0000000000000000-mapping.dmp

Download
memory/932-83-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-65-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-59-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-68-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/968-130-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-56-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-60-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-61-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-67-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-70-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-69-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-57-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-66-0x0000000000C88814-mapping.dmp

Download
memory/968-77-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-62-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/968-63-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1108-128-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1108-123-0x0000000000C88814-mapping.dmp

Download
memory/1108-153-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1180-356-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1180-331-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1180-267-0x0000000000C88814-mapping.dmp

Download
memory/1180-273-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1216-364-0x0000000000000000-mapping.dmp

Download
memory/1216-109-0x0000000000000000-mapping.dmp

Download
memory/1284-133-0x0000000000000000-mapping.dmp

Download
memory/1428-178-0x0000000000000000-mapping.dmp

Download
memory/1504-147-0x0000000000C88814-mapping.dmp

Download
memory/1504-175-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1504-152-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1564-384-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1564-383-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1564-378-0x0000000000C88814-mapping.dmp

Download
memory/1580-253-0x0000000000000000-mapping.dmp

Download
memory/1640-101-0x0000000000C88814-mapping.dmp

Download
memory/1640-131-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1640-106-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1684-201-0x0000000000000000-mapping.dmp

Download
memory/1692-295-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1692-221-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1692-251-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1692-215-0x0000000000C88814-mapping.dmp

Download
memory/1708-82-0x0000000074381000-0x0000000074383000-memory.dmp

Filesize
8KB

Download
memory/1708-80-0x0000000000000000-mapping.dmp

Download
memory/1708-84-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1752-87-0x0000000000000000-mapping.dmp

Download
memory/1812-192-0x0000000000C88814-mapping.dmp

Download
memory/1812-222-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1812-197-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2004-246-0x0000000000000000-mapping.dmp

Download
memory/2248-275-0x0000000000000000-mapping.dmp

Download
memory/2288-330-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2288-289-0x0000000000C88814-mapping.dmp

Download
memory/2288-294-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2424-326-0x0000000001712000-mapping.dmp

Download
memory/2424-359-0x0000000001611000-0x00000000016BD000-memory.dmp

Filesize
688KB

Download
memory/2424-358-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/2424-385-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/2480-298-0x0000000000000000-mapping.dmp

Download
memory/2524-361-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2524-328-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2524-312-0x0000000000C88814-mapping.dmp

Download
memory/2864-333-0x0000000000000000-mapping.dmp

Download
memory/2892-362-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2892-357-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2892-347-0x0000000000C88814-mapping.dmp

Download