xtremerat | 5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

Analysis

max time kernel
150s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Size

515KB
MD5

066dd80d4b026fb182eb1fab64971ee1
SHA1

f97b97883304ee4fbeeefd4d247c13b8e0a02516
SHA256

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1
SHA512

854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065
SSDEEP

12288:iBDNRR3byG8UrHl+WGmEsdh+DCkbFX93yRotNNpbcqrthv5xq:iBDNRR3byGtFBGZJCkbFXIyNpbcqt

Score

10^/10

xtremerat persistence rat spyware upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

explorer.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat

Adds policy Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exeexplorer.exeexplorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe

Executes dropped EXE 10 IoCs

Processes:

winregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe

pid	process
1476	winregedigr.exe
3748	winregedigr.exe
1368	winregedigr.exe
4444	winregedigr.exe
4960	winregedigr.exe
1960	winregedigr.exe
3812	winregedigr.exe
1760	winregedigr.exe
2248	winregedigr.exe
4660	winregedigr.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3080-159-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/3080-160-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/3080-161-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/3080-164-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/3080-166-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/3080-168-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/3080-167-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4828-230-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4828-233-0x0000000001610000-0x0000000001715000-memory.dmp	upx
behavioral2/memory/4828-231-0x0000000001610000-0x0000000001715000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winregedigr.exe5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	winregedigr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe

Adds Run key to start application 2 TTPs 44 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exeexplorer.exewinregedigr.exewinregedigr.exesvchost.exewinregedigr.exewinregedigr.exewinregedigr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\winservicesd = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\InstallDir\\winregedigr.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\InstallDir\\winregedigr.exe"	winregedigr.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	winregedigr.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe

Suspicious use of SetThreadContext 9 IoCs

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe

description	pid	process	target process
PID 4376 set thread context of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 1476 set thread context of 3748	1476	winregedigr.exe	winregedigr.exe
PID 3748 set thread context of 3080	3748	winregedigr.exe	explorer.exe
PID 1368 set thread context of 4444	1368	winregedigr.exe	winregedigr.exe
PID 4960 set thread context of 1960	4960	winregedigr.exe	winregedigr.exe
PID 3812 set thread context of 1760	3812	winregedigr.exe	winregedigr.exe
PID 2248 set thread context of 4660	2248	winregedigr.exe	winregedigr.exe
PID 1760 set thread context of 4828	1760	winregedigr.exe	explorer.exe
PID 4660 set thread context of 5108	4660	winregedigr.exe	explorer.exe

Drops file in Windows directory 18 IoCs

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exe

description	ioc	process
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
File opened for modification	C:\Windows\InstallDir\	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File created	C:\Windows\InstallDir\winregedigr.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe
File opened for modification	C:\Windows\InstallDir\winregedigr.exe	winregedigr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 24 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	explorer.exe

Modifies registry class 3 IoCs

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exesvchost.exewinregedigr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	winregedigr.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exe

pid process

3080 explorer.exe
3080 explorer.exe
4828 explorer.exe
4828 explorer.exe
5108 explorer.exe
5108 explorer.exe

pid	process
3080	explorer.exe
3080	explorer.exe
4828	explorer.exe
4828	explorer.exe
5108	explorer.exe
5108	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exewinregedigr.exeexplorer.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exewinregedigr.exeexplorer.exe

pid	process
4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
1476	winregedigr.exe
3080	explorer.exe
1368	winregedigr.exe
4960	winregedigr.exe
4444	winregedigr.exe
3812	winregedigr.exe
2248	winregedigr.exe
4828	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe

description	pid	process	target process
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4376 wrote to memory of 4908	4376	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
PID 4908 wrote to memory of 5056	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 4908 wrote to memory of 5056	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 4908 wrote to memory of 5056	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 4908 wrote to memory of 5056	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	svchost.exe
PID 4908 wrote to memory of 1664	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 1664	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 528	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 528	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 528	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 5076	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 5076	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 5076	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 5076	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 2276	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 2276	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 1832	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 1832	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 1832	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 1864	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 1864	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 2248	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 2248	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 2248	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 1936	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 1936	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 1104	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 1104	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 1104	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 4836	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 4836	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 632	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 632	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 632	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 4336	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 4336	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 4824	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 4824	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 4824	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 2888	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 2888	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 2140	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 2140	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 2140	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 1876	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 1876	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 5008	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 5008	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 5008	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe
PID 4908 wrote to memory of 2416	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 2416	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	msedge.exe
PID 4908 wrote to memory of 2420	4908	5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
"C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4376

C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe
"C:\Users\Admin\AppData\Local\Temp\5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1.exe"
2⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Modifies registry class
PID:5056

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1368

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4760

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3372

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3448

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3636

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4704

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3100

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:2412

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:1964

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:740

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3204

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3824

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4044

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:1484

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:2192

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4964

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3736

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4436

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4780

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3812

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
7⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
8⤵
PID:1936

C:\Windows\SysWOW64\explorer.exe
explorer.exe
8⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4828

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4972

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:5088

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4716

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:4628

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
PID:1544

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
5⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:4660

C:\Windows\SysWOW64\explorer.exe
explorer.exe
6⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
6⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:1664

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:528

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2276

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:1864

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:1936

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4836

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:632

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2888

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:1876

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2416

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3112

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3616

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3640

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:2092

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:4488

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:1040

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:5112

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
3⤵
PID:3164

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:260

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1476

C:\Windows\InstallDir\winregedigr.exe
"C:\Windows\InstallDir\winregedigr.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
5⤵
PID:3488

C:\Windows\SysWOW64\explorer.exe
explorer.exe
5⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.dat
Filesize
2B

MD5
93e00066d099c0485cfffa1359246d26

SHA1
bc69a773f37b2f2071e25f755a66d47b871e5d98

SHA256
3b271649a94ad5be4ef46ecbb6a4e7363e8498b7e69b751737bf30df2e0d1dde

SHA512
d3dfe508cacae7d36f13908134b5b438b87429fcf93ccb060bcfa346c04633a99e9ca497297418c969537be1da2405171982794055dd0f52e59a82720d3b3d02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.nfo
Filesize
3KB

MD5
1e660987352cb96d468eff4845fca2c1

SHA1
ebefd0422f157795456bc10dab9c78e1b4790fe7

SHA256
d0558bed1f840eb7602b608ccbf40c7a0de30be198150d7101f556438a405e91

SHA512
f2817698da450fcbdb1cb7dca396d3dbee2be340a00b9e588b23f219357b0d2f1bea4bba16bd4510f67d39a20e62e6493d0c199dcb1890140cd0442d5872c5cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.svr
Filesize
346KB

MD5
b6d63330959896290103db9786bd33d6

SHA1
b2558e1b4c6d9e012801a6e6564cf44fa16d6d14

SHA256
38d68f85dd0d99524efb7b537ce8fc5c7494126da1455a8d700cec51ef021c24

SHA512
54cd768f2df8e7e570a95073e1727465c6c22945334e33b835608b8933ef81d59eb33b3b5b434dde5c8b2f25130b417a076916fa4b7fcd9c33a133681cecc9b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\42mqzyCqTa60\42mqzyCqTa60.svr
Filesize
346KB

MD5
b6d63330959896290103db9786bd33d6

SHA1
b2558e1b4c6d9e012801a6e6564cf44fa16d6d14

SHA256
38d68f85dd0d99524efb7b537ce8fc5c7494126da1455a8d700cec51ef021c24

SHA512
54cd768f2df8e7e570a95073e1727465c6c22945334e33b835608b8933ef81d59eb33b3b5b434dde5c8b2f25130b417a076916fa4b7fcd9c33a133681cecc9b2

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
C:\Windows\InstallDir\winregedigr.exe
Filesize
515KB

MD5
066dd80d4b026fb182eb1fab64971ee1

SHA1
f97b97883304ee4fbeeefd4d247c13b8e0a02516

SHA256
5c5f517068959cb1ec7a7c995727680646c83c69efe5c8ae9a629edd67fbb9a1

SHA512
854e01365b77cf07c3535df7beed4af28f36d510d6deb3514e47eba32e7a01351e6d27ddc9b8baf4558c91180edc718fee10f5df045f81b590c9d89aedf82065

Download Submit
memory/1368-177-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1368-175-0x0000000000000000-mapping.dmp

Download
memory/1476-148-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1476-146-0x0000000000000000-mapping.dmp

Download
memory/1760-204-0x0000000000000000-mapping.dmp

Download
memory/1760-223-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1960-196-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/1960-191-0x0000000000000000-mapping.dmp

Download
memory/1960-198-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/2248-209-0x0000000000000000-mapping.dmp

Download
memory/3080-173-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/3080-160-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/3080-172-0x0000000001611000-0x00000000016BD000-memory.dmp

Filesize
688KB

Download
memory/3080-159-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/3080-174-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/3080-167-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/3080-168-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/3080-166-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/3080-158-0x0000000000000000-mapping.dmp

Download
memory/3080-171-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/3080-161-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/3080-164-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/3748-165-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/3748-151-0x0000000000000000-mapping.dmp

Download
memory/3812-201-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3812-199-0x0000000000000000-mapping.dmp

Download
memory/4376-132-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/4444-220-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4444-185-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4444-226-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4444-180-0x0000000000000000-mapping.dmp

Download
memory/4660-246-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4660-216-0x0000000000000000-mapping.dmp

Download
memory/4828-231-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4828-248-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/4828-247-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/4828-245-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/4828-233-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4828-230-0x0000000001610000-0x0000000001715000-memory.dmp

Filesize
1.0MB

Download
memory/4828-222-0x0000000000000000-mapping.dmp

Download
memory/4908-162-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4908-145-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4908-139-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4908-136-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4908-137-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4908-135-0x0000000000000000-mapping.dmp

Download
memory/4908-138-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/4960-186-0x0000000000000000-mapping.dmp

Download
memory/5056-143-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/5056-140-0x0000000000000000-mapping.dmp

Download
memory/5076-144-0x0000000000C80000-0x0000000000CEC000-memory.dmp

Filesize
432KB

Download
memory/5076-142-0x0000000000000000-mapping.dmp

Download
memory/5108-244-0x00000000016BD000-0x0000000001713000-memory.dmp

Filesize
344KB

Download
memory/5108-235-0x0000000000000000-mapping.dmp

Download