e8f77c6ed8ccf23a9a3aecceadf0794f486ea39f6fd9f99a8c249cfef30af3c3

Analysis

max time kernel
75s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2022 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Half-Life.bat
Size

290B
MD5

f74e6b5246c889bbed2ab6458d00b16c
SHA1

87823a620d7eab058b6e490b64957b57d70895a0
SHA256

e8f77c6ed8ccf23a9a3aecceadf0794f486ea39f6fd9f99a8c249cfef30af3c3
SHA512

3a1edf80ed520dbfca88beb69b62db3e520227c8f8e3b1b9356600d029ad8d098662693c4798d8b07aa73ae3ac61adb0ab02c9ec4bdc1a76f249027be3f82949

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SET5D24.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET5D24.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe

Executes dropped EXE 9 IoCs

pid	Process
1216	cgsetup_en_52GyYvig6QSzND3sbkgg.exe
4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
932	Dashboard.exe
1340	Dashboard.Service.exe
3560	Dashboard.Service.exe
2660	wyUpdate.exe
5192	tap-windows-9.21.2.exe
5232	tapinstall.exe
5284	tapinstall.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Dashboard.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	cgsetup_en_52GyYvig6QSzND3sbkgg.exe

Loads dropped DLL 9 IoCs

pid	Process
5192	tap-windows-9.21.2.exe
5192	tap-windows-9.21.2.exe
5192	tap-windows-9.21.2.exe
5192	tap-windows-9.21.2.exe
5192	tap-windows-9.21.2.exe
5192	tap-windows-9.21.2.exe
5192	tap-windows-9.21.2.exe
5820	MsiExec.exe
5868	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\SET513E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF	MsiExec.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\wyUpdate.exe.log	wyUpdate.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\SET514E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\SET513D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\SET513D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB	Dashboard.Service.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_46E4040B4A28D439FBFA7E9FC642442C	Dashboard.Service.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F	Dashboard.Service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\usbnet.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\CyberGhost 8\Applications\Updater\fr\Updater.resources.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\MT.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\NF.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\TD.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Tools\mtr.exe	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\JsonSubTypes.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\KP.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\KR.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\LC.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\AntiVirus\Microsoft.WindowsAPICodePack.ShellExtensions.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\pl\Updater.resources.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\OpenVPN\x86\tap-windows-9.21.2.exe	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\LV.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Onboarding\NewDot.svg	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\DarkTheme\Logos\[email protected]	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\PA.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Ghosties\[email protected]	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\VC.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Logos\updaterRed.svg	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\LaunchDarkly.CommonSdk.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Data\Assets\Default\Ghosties\Foodsteps.svg	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\MZ.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Ghosties\LogoError.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Ghosties\cg_updater_b.svg	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\de\CyberGhost.Controls.resources.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\pt\Updater.Core.resources.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\AL.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\KH.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\SI.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Data\Assets\Default\Logos\[email protected]	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Ghosties\[email protected]	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Licenses\Microsoft.Management.Infrastructure.txt	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\CyberGhost\Logos\[email protected]	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\ID.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\PL.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\NO.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\MM.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\openvpn.exe	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Licenses\Hardcodet.NotifyIcon.Wpf.txt	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\CyberGhost\Licenses\Serilog.Formatting.Compact.Reader.txt	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Dashboard.Service.exe	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\CyberGhost\Icons\regular.ico	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\ET.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\RE.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\GH.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\TN.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Dashboard.MPAHelper.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\Data\Assets\Default\Backgrounds\background.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\JE.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\FK.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\PrivacyGuard\Data\Assets\Default\Ghosties\CustomBlue.svg	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\BL.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\ML.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\PW.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\BJ.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\ru\CyberGhost.VPN.resources.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Logos\updaterYellow.svg	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\OpenVPN\x86\libcrypto-1_1.dll	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\Assets\Default\Flags\64\GU.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\Updater\Data\Assets\Default\Logos\disabled.ico	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\CyberGhost\Ghosties\ghostie_briefly.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\TK.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Applications\VPN\Data\Assets\Default\Flags\64\UN.png	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
File created	C:\Program Files\CyberGhost 8\Data\OpenVPN\x64\openvpn.exe	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\Installer\e57607f.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\Installer\e57607f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6273.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62E1.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI64C7.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{677232D6-72D6-4821-8CB5-47969B15D4DF}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Dashboard.exe = "11000"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Dashboard.exe = "1"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\Dashboard.exe = "1"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\Dashboard.exe = "0"	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\Dashboard.exe = "1"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION\Dashboard.exe = "1"	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\Dashboard.exe = "0"	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Dashboard.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	Dashboard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Dashboard.exe = "0"	Dashboard.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	wyUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	Dashboard.Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	Dashboard.Service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wyUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	Dashboard.Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	Dashboard.Service.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2176	chrome.exe
2176	chrome.exe
4740	chrome.exe
4740	chrome.exe
932	chrome.exe
932	chrome.exe
4056	chrome.exe
4056	chrome.exe
4936	chrome.exe
4936	chrome.exe
364	chrome.exe
364	chrome.exe
4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
1264	chrome.exe
1264	chrome.exe
2988	chrome.exe
2988	chrome.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
3560	Dashboard.Service.exe
5516	chrome.exe
5516	chrome.exe
5740	msiexec.exe
5740	msiexec.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
656	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	cgsetup_en_52GyYvig6QSzND3sbkgg.exe
Token: SeDebugPrivilege	4336	1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
Token: SeDebugPrivilege	932	Dashboard.exe
Token: SeDebugPrivilege	3560	Dashboard.Service.exe
Token: SeDebugPrivilege	2660	wyUpdate.exe
Token: SeAuditPrivilege	5360	svchost.exe
Token: SeSecurityPrivilege	5360	svchost.exe
Token: SeLoadDriverPrivilege	5284	tapinstall.exe
Token: SeRestorePrivilege	5608	DrvInst.exe
Token: SeBackupPrivilege	5608	DrvInst.exe
Token: SeLoadDriverPrivilege	5608	DrvInst.exe
Token: SeLoadDriverPrivilege	5608	DrvInst.exe
Token: SeLoadDriverPrivilege	5608	DrvInst.exe
Token: SeShutdownPrivilege	5704	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5704	msiexec.exe
Token: SeSecurityPrivilege	5740	msiexec.exe
Token: SeCreateTokenPrivilege	5704	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5704	msiexec.exe
Token: SeLockMemoryPrivilege	5704	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5704	msiexec.exe
Token: SeMachineAccountPrivilege	5704	msiexec.exe
Token: SeTcbPrivilege	5704	msiexec.exe
Token: SeSecurityPrivilege	5704	msiexec.exe
Token: SeTakeOwnershipPrivilege	5704	msiexec.exe
Token: SeLoadDriverPrivilege	5704	msiexec.exe
Token: SeSystemProfilePrivilege	5704	msiexec.exe
Token: SeSystemtimePrivilege	5704	msiexec.exe
Token: SeProfSingleProcessPrivilege	5704	msiexec.exe
Token: SeIncBasePriorityPrivilege	5704	msiexec.exe
Token: SeCreatePagefilePrivilege	5704	msiexec.exe
Token: SeCreatePermanentPrivilege	5704	msiexec.exe
Token: SeBackupPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5704	msiexec.exe
Token: SeShutdownPrivilege	5704	msiexec.exe
Token: SeDebugPrivilege	5704	msiexec.exe
Token: SeAuditPrivilege	5704	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5704	msiexec.exe
Token: SeChangeNotifyPrivilege	5704	msiexec.exe
Token: SeRemoteShutdownPrivilege	5704	msiexec.exe
Token: SeUndockPrivilege	5704	msiexec.exe
Token: SeSyncAgentPrivilege	5704	msiexec.exe
Token: SeEnableDelegationPrivilege	5704	msiexec.exe
Token: SeManageVolumePrivilege	5704	msiexec.exe
Token: SeImpersonatePrivilege	5704	msiexec.exe
Token: SeCreateGlobalPrivilege	5704	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe
Token: SeRestorePrivilege	5740	msiexec.exe
Token: SeTakeOwnershipPrivilege	5740	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe
4740	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 1568	4740	chrome.exe	86
PID 4740 wrote to memory of 1568	4740	chrome.exe	86
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2592	4740	chrome.exe	89
PID 4740 wrote to memory of 2176	4740	chrome.exe	90
PID 4740 wrote to memory of 2176	4740	chrome.exe	90
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91
PID 4740 wrote to memory of 4612	4740	chrome.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Half-Life.bat"
1⤵
PID:4864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff896f94f50,0x7ff896f94f60,0x7ff896f94f70
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:2
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2380
- - C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff6f66fa890,0x7ff6f66fa8a0,0x7ff6f66fa8b0
    3⤵
    PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Users\Admin\Downloads\cgsetup_en_52GyYvig6QSzND3sbkgg.exe
  "C:\Users\Admin\Downloads\cgsetup_en_52GyYvig6QSzND3sbkgg.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- - C:\Users\Admin\AppData\Local\Temp\889ddf7c-911a-4037-81f3-75d63b378d11\1cf298ca-7f46-4288-ad05-1c70ede1be67.exe
    "C:\Users\Admin\AppData\Local\Temp\889ddf7c-911a-4037-81f3-75d63b378d11\1cf298ca-7f46-4288-ad05-1c70ede1be67.exe" "C:\Users\Admin\Downloads\cgsetup_en_52GyYvig6QSzND3sbkgg.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
  - - C:\Program Files\CyberGhost 8\Dashboard.exe
      "C:\Program Files\CyberGhost 8\Dashboard.exe" /install
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Modifies Internet Explorer settings
      Suspicious use of AdjustPrivilegeToken
      PID:932
    - - C:\Program Files\CyberGhost 8\Dashboard.Service.exe
        
        "C:\Program Files\CyberGhost 8\Dashboard.Service.exe" --install
        5⤵
        Executes dropped EXE
        
        PID:1340
    - - C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\tap-windows-9.21.2.exe
        
        "C:\Program Files\CyberGhost 8\Applications\VPN\Data\OpenVPN\x64\tap-windows-9.21.2.exe" /S
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5192
      - C:\Program Files\TAP-Windows\bin\tapinstall.exe
        
        "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
        6⤵
        Executes dropped EXE
        Checks SCSI registry key(s)
        
        PID:5232
      - C:\Program Files\TAP-Windows\bin\tapinstall.exe
        
        "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:5284
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Program Files\CyberGhost 8\Applications\VPN\Data\WireGuard\tun-driver64.msi" /qn REBOOT=ReallySuppress
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5704
  - - C:\Program Files\CyberGhost 8\Dashboard.exe
      "C:\Program Files\CyberGhost 8\Dashboard.exe" /firststart
      4⤵
      PID:2776
    - - C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe
        
        "C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\CyberGhost 8\debug.log" --mojo-platform-channel-handle=6204 --field-trial-handle=5896,i,10382616755843598083,13008470222249626761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2 --host-process-id=2776
        5⤵
        
        PID:4436
    - - C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe
        
        "C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\CyberGhost 8\debug.log" --mojo-platform-channel-handle=6364 --field-trial-handle=5896,i,10382616755843598083,13008470222249626761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=2776
        5⤵
        
        PID:5468
    - - C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe
        
        "C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Program Files\CyberGhost 8\debug.log" --mojo-platform-channel-handle=6400 --field-trial-handle=5896,i,10382616755843598083,13008470222249626761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 --host-process-id=2776
        5⤵
        
        PID:2016
    - - C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe
        
        "C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --first-renderer-process --no-sandbox --log-file="C:\Program Files\CyberGhost 8\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=6552 --field-trial-handle=5896,i,10382616755843598083,13008470222249626761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=2776 /prefetch:1
        5⤵
        
        PID:2652
    - - C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe
        
        "C:\Program Files\CyberGhost 8\Data\Cef\x64\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Program Files\CyberGhost 8\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=6560 --field-trial-handle=5896,i,10382616755843598083,13008470222249626761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker --host-process-id=2776 /prefetch:1
        5⤵
        
        PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1624,14778102642109331515,11801313516241215194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:5528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Program Files\CyberGhost 8\Dashboard.Service.exe
"C:\Program Files\CyberGhost 8\Dashboard.Service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3560
- C:\Program Files\CyberGhost 8\wyUpdate.exe
  "C:\Program Files\CyberGhost 8\wyUpdate.exe" /justcheck /quickcheck /noerr -server="https://download.cyberghostvpn.com/windows/updates/8/nt/wyserver.wys"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /d *
  2⤵
  PID:6016
- C:\Windows\system32\netsh.exe
  "netsh" interface ip set address "Ethernet 2" static 169.254.123.57 255.255.0.0
  2⤵
  PID:6044
- C:\Windows\system32\netsh.exe
  "netsh" interface set interface "Ethernet 2" DISABLED
  2⤵
  PID:5268
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip
  2⤵
  PID:744
- C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe
  "C:\Program Files\CyberGhost 8\Applications\VPN\Data\Tools\nvspbind.exe" "Ethernet 2" /e ms_tcpip6
  2⤵
  PID:5440
- C:\Windows\system32\netsh.exe
  "netsh" interface set interface "Ethernet 2" ENABLED
  2⤵
  PID:5680
- C:\Windows\system32\netsh.exe
  "netsh" interface ipv6 set teredo disable
  2⤵
  PID:5212
- C:\Windows\system32\netsh.exe
  "netsh" interface ip set address "Ethernet 2" static 169.254.123.200 255.255.0.0
  2⤵
  PID:5528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:4728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2236

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{81638d76-e9dd-3c48-82e7-16ef32f15f7f}\oemvista.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000140" "208" "c:\program files\tap-windows\driver"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:5392
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{3e967ebd-c04f-a34e-9931-e7d3c1851ef4} Global\{44e1f398-9d05-b845-abea-9d76b61366bc} C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{5378a721-ef03-c943-8ad5-ad2505f492fd}\tap0901.cat
  2⤵
  - Modifies system certificate store
  PID:5424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5360
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\d0fdf2fae4cf0c951d0c167a25264d7b98ff8b807c641bd45fdcfbb7f9f76709\wintun.inf" "9" "46beb126b" "0000000000000154" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\Temp\d0fdf2fae4cf0c951d0c167a25264d7b98ff8b807c641bd45fdcfbb7f9f76709"
  2⤵
  PID:5936

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5740
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 3755E4F8E1A449C5938B60B63837FB2B
  2⤵
  - Loads dropped DLL
  PID:5820
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9624D69FDE1465FBCE8CA5697F3556A7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:5868

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\CyberGhost 8\Applications\AntiVirus\AntiVirus.dll

Filesize
340KB

MD5
81f60bb3c4825cc411873c92ff403077

SHA1
2ab32b4a1c3fac14a198d427077c87d01923af92

SHA256
57127853974396db826cdaa56058d39749e8654baf6ba595f3a4712a7230e731

SHA512
8a9fa259e93ae0f5d1efbfecdebad754abddbb11499ae6182454999c954b04a1fc286e21ad9c922fa494a81fedc5aa54cc32a286e6192325eb46bb55a457557b

Download Submit
C:\Program Files\CyberGhost 8\Autofac.dll

Filesize
236KB

MD5
4967eb74a5173cc966bc08a434363701

SHA1
49fb8a69ed216db994e23a1f45c793d5315bba7b

SHA256
81e91ad464f377fcca6f04fbc8f2eecdec41bf667185f7df5cb3159fcd07f133

SHA512
92dec397a4f608176d229e92558fbb5391b153012ac8551bbea72373b06e0ed6382c92b26b216a180213fdaffc17a269406a244ebe139855b7277ee93c34c00b

Download Submit
C:\Program Files\CyberGhost 8\Castle.Core.dll

Filesize
441KB

MD5
5be78750c920cd6160ec18b5861dc885

SHA1
c9274ad66be5e3f2bf999c9e929c1a8b771a0e73

SHA256
e270fdd3ed9962f552f66d6f9f2e81fbab4c193d153e746d6e3b089f42b752d3

SHA512
ef6eb4a264d56687b4874280022f278660a7742be3bf8d8c6af8908d2542bf8e67005f06dcc1ee72499a8c94d4e88ca9f9091451a0bd089ab27bb67112f2de70

Download Submit
C:\Program Files\CyberGhost 8\CyberGhost.Browser.dll

Filesize
53KB

MD5
f5eaf73a0a001f0dddd2ce00f00928c2

SHA1
8ea883fbcc1fb763ac19dc0da58e86cbc725fd1e

SHA256
69fa255a13c9d3bcad72421d99bcec91ed8b35cb64e54984409d9f125dcac1ff

SHA512
16cad47c0ee30164a6b8a8935893422c8c12b0812c6d36125a8ff8e5ef5311973bb9546b61511c2cc2e9f950cd3daf4504d2d83b6e5fb1dccc37271c51d43e61

Download Submit
C:\Program Files\CyberGhost 8\CyberGhost.Controls.dll

Filesize
627KB

MD5
c76fe990bd6945db1601b74a842ac730

SHA1
3994bc13be6e98b4ee1760280e626cb8cdbce85d

SHA256
50a6729c8d0e10cccfefe6764acb9ba00ed066ab10a549d577e88d4c0c739f42

SHA512
b383ba984ea3657016618ffcfe604fa5531462d50bb6f0c728bf33603a5f885b611d7342d9e51f26b0319035fe71989c1b7ae6c36f19647b1b73ba6c6d1c6675

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Contracts.dll

Filesize
204KB

MD5
a00b936d6cf4c11a2c68167fa1e28ef5

SHA1
97f4f758951c610e3e0945f42a4e9f7bb2c72a17

SHA256
172c89fdd4210a0ebdd45334f3716f213fd4f412978286aa787eb2a22231e7d0

SHA512
161cd7b7b25b0509c6b4f76ad995361a595ba9c64f9582c8024cb7eb2ddabd69d5beb6d68cae8dd33386486a72ad83ef2b47e08d350f81645e806f30deea590e

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Core.dll

Filesize
197KB

MD5
ed9bf0893419f045d6c487f9aa104b49

SHA1
bfda2909e3168825df27d7e08727305335d8a453

SHA256
5dde49e4c8ab75a57de568d3aaab850070be60b550f5f4bf2c614d16dc50bfd7

SHA512
9d7ea22f2b4cf87f55c7a2e7fd71d2019f8b0db8e5fa118bf4f3327960b70c3e9d8f53b1128430f33759977a08869a8141449830b6b0b378539557a82f12ae49

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.MPAHelper.dll

Filesize
156KB

MD5
14f256faf16b929b13b77a69969e231e

SHA1
577e0ec20aa649ae6239ceb461a56dac1e06e253

SHA256
7557fa442f150ff10b7096ff9682df4728b5d6d4729c59c0401b756fde7a2c8c

SHA512
78bd22f755bcc7205a9f4df38c95f9984876c1462a6a98a1bf583de220150ab12fa993512a8a97a39eef5455f7dbd410a492402789c825ba4eb95dedfb926caa

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Pipes.dll

Filesize
31KB

MD5
f15ef1481c42ed7170fa10c3c5b7d507

SHA1
5a487bf04d5cccd53d9f70ebf7f192375a6003ee

SHA256
d410d3fda23710385c088d84b9a846e51c5be6829a77b5c1637634be1a089c62

SHA512
e23e841238f83bc613ebac53067c3f1cc278eb80712538ef13fae023867cf976ba357c5b3565308df2a00431e4acb0822a373d3af31c8add21144d8b9a64c753

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Service.exe

Filesize
67KB

MD5
84a05773da0ff681ca0fcba762006fb1

SHA1
5490d36af2117eaccb43d60c7aba1f72f0eb06bc

SHA256
070abd144e4e0dabf783fe108b32eb38bd452726c7955263594682da74df6de1

SHA512
6befca2dccb8af3b4d81e2d725efc9f6bd1432563018f2b27db85991a86897c12e89feb6bdf9f2bc7c68e7da593430cee95f0a78792ba1af078501015cd66905

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Service.exe

Filesize
67KB

MD5
84a05773da0ff681ca0fcba762006fb1

SHA1
5490d36af2117eaccb43d60c7aba1f72f0eb06bc

SHA256
070abd144e4e0dabf783fe108b32eb38bd452726c7955263594682da74df6de1

SHA512
6befca2dccb8af3b4d81e2d725efc9f6bd1432563018f2b27db85991a86897c12e89feb6bdf9f2bc7c68e7da593430cee95f0a78792ba1af078501015cd66905

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Service.exe

Filesize
67KB

MD5
84a05773da0ff681ca0fcba762006fb1

SHA1
5490d36af2117eaccb43d60c7aba1f72f0eb06bc

SHA256
070abd144e4e0dabf783fe108b32eb38bd452726c7955263594682da74df6de1

SHA512
6befca2dccb8af3b4d81e2d725efc9f6bd1432563018f2b27db85991a86897c12e89feb6bdf9f2bc7c68e7da593430cee95f0a78792ba1af078501015cd66905

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.Service.exe.config

Filesize
909B

MD5
e2338d4401885fc1abec3ed8bbccd958

SHA1
fe9007da5f2e1ef7a456b4267b58106a6e3b1645

SHA256
eb9201e1687c3ccbe326897dc10ffd4f5ce172be9c3b17c4e154fcb70ce76133

SHA512
03041eb66dfd15c356f4de60d10c435809833bfa66f67d951ed54495dbd0e0985a871febd69c5d6104845adc3de4c984bf9d55e46399ac1956011a485273dff6

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.exe

Filesize
1.3MB

MD5
b9479bf714837d1f60f9880f8e290f33

SHA1
af5c53c8efb5c30a8e7c69da1960c696aeb17683

SHA256
dbfff227020c3d5e840571a910490f379b1e103aed251b636f52ee5b9709f698

SHA512
c8c97b34e93793893a72c79bb5cfd31e5053f0d07f0a87d5eab0173dd9c12b40244efb4d9894046bc180e67c6ab464e0a4aae315f78744c2edc5b5bedea0a560

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.exe

Filesize
1.3MB

MD5
b9479bf714837d1f60f9880f8e290f33

SHA1
af5c53c8efb5c30a8e7c69da1960c696aeb17683

SHA256
dbfff227020c3d5e840571a910490f379b1e103aed251b636f52ee5b9709f698

SHA512
c8c97b34e93793893a72c79bb5cfd31e5053f0d07f0a87d5eab0173dd9c12b40244efb4d9894046bc180e67c6ab464e0a4aae315f78744c2edc5b5bedea0a560

Download Submit
C:\Program Files\CyberGhost 8\Dashboard.exe.config

Filesize
1KB

MD5
ef7fb38a6da851e9b2ad3c62002607dd

SHA1
b74e836936794952b5d739f0d75eb3ee50f3a61c

SHA256
870949fd91b0595a9d237dbc3fc3ce3b6b9126c721182116877550e6d1010989

SHA512
0e3df69fc8c1294f1a37d150e3f205a9f61fad4c8c64bc6306df9c08a3c3debc2444c5bae78140ba8cea5b91d42aa3e138f4fb92705842201c11a50476aeeb01

Download Submit
C:\Program Files\CyberGhost 8\MobileConcepts45.dll

Filesize
596KB

MD5
f8010c6631166cbbafa224bc625dbeae

SHA1
b65d7a3333472b8b78d7e61b3aaaa3e2547f9aa3

SHA256
b7093d349cd231cea5955c75ec8d7b4964437fb1da6af9157463d5624b81149e

SHA512
ff5d014007da753ffe23a52090e408f23105884ec4b80856ebb351d9fa41cd225362a6d9a93f1b35943c36fbf058ee09fc234f1e0d94d5b31150060fa57014b6

Download Submit
C:\Program Files\CyberGhost 8\Newtonsoft.Json.dll

Filesize
687KB

MD5
cc857ef8da12c7e6c0e7842c54037fd3

SHA1
5ec4f486b3d10e2158bfb9ff5adc32bfd42d81cf

SHA256
e0205d1b03cbb1bd88eee8ebd8188939445a169c600449d4915b896080ce9ab7

SHA512
24cecec9eb9ab3ef03bccf1ff01628d1394e9da6a2fe86d04592537a16bbceeec951d518d466b5f5aa3823d4d7d0e96e77d5d540126d579abebf5b08e972b0b4

Download Submit
C:\Program Files\CyberGhost 8\Serilog.Formatting.Compact.dll

Filesize
18KB

MD5
553d6ae051c09266847d04ef9049cdc9

SHA1
c1f845a787297d710eef675fcb4f7353a1c7ee1b

SHA256
8d211708bf43edb971100a8110090b2537cc87b3490c359c24978b9c78ba9f7d

SHA512
043e1f9c293ca8122765771f30cd609a4a3a00388ac1d3dca2b80dcfdda72f62c1e2c92dee9eb15e87112d5f1ef2759caffddee9a44ef3c5b5f15522dc29b4fe

Download Submit
C:\Program Files\CyberGhost 8\Serilog.dll

Filesize
133KB

MD5
310269a204fc70ee6cb52b9b2fce638e

SHA1
630f0bc9e6d9b9bea0c852875bb6e0aac83c5615

SHA256
93632d93396c8da17cdd4f6b92e9aa162bcf0d0ddf9a262477f769e0df926d12

SHA512
7e60693276b0df0ee33ef9eff51199af63aa0f3b9efdc6c1739cec6c13965f6393c06e4b365cf648591fc01d291c348850473269bab629bfb107d31e50cbbca0

Download Submit
C:\Program Files\CyberGhost 8\SharpRaven.dll

Filesize
100KB

MD5
a183f0d155bd482f1e36c83c6eb0f6ba

SHA1
4345e30aed0f06402bafbe741e98a06af96069f6

SHA256
dbee5b72b6c0f4edded375c224abb31d9387087946a53c5f5b12c4e6223aa471

SHA512
19b46dae942df4751353d2c3cd949f51fde13fa6be6aaed5816f95ef4465e645bba9459a83537ba5e7db7db06e09f3477395e18280f2df568bf3ddafb50817b5

Download Submit
C:\Program Files\CyberGhost 8\WPFLocalizeExtension.dll

Filesize
87KB

MD5
d73e77745045915f4d6618cc28b6d801

SHA1
463e4efa398ab4c1a3c6a833437eb28a8c52537a

SHA256
652e84820a7671bbf64798b114e16a5b630e4fbd57e32f4ac4d8e23e8cb6801f

SHA512
f856ab8787c50b09ac36c81649e0e5f647e6708c92099a5b9d21ca00215fa95b6dd840065dc035ed9febd9f5a40422395a663ca6bc52f43451e9da622ae491b6

Download Submit
C:\Program Files\CyberGhost 8\XAMLMarkupExtensions.dll

Filesize
39KB

MD5
e4a7061bfe27358a3cafa17f3ef3e427

SHA1
9178f8f84b48ae9de63ee24d920c00b8e87b4606

SHA256
aa7764b37122eb98d73c1ed2cb1eb5a01287841d117da8fc7da4f5029c851c6e

SHA512
edda7a5a759abd4db1095a53831f4d30b6035243f4ec5a2cadcd0d0e24e13492f73001b9a73b8cf09dc7e2040e398dcd0485fe075089e538a390db20e193a20b

Download Submit
C:\Program Files\CyberGhost 8\wyUpdate.exe

Filesize
426KB

MD5
2bc3df2af6a5df53327a52f29ef7fdd5

SHA1
fdddbd3aad9cef21f11e2dc5a0fc1c9115be2b7d

SHA256
282ce0ea78b42ff7313b0026abfeb7fe500caa1b2fa3556c141488f673817b34

SHA512
6adb1118bd77ac10a076577e9785ca96ed05c85b8f45d059a0eb16956b5d7001d279d2779ff1accd5142f3eb9f258153a488626111a2ed9b07234adfcd906557

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9

Filesize
506B

MD5
709558dd211a25c360b2df733d6b57a9

SHA1
1b6689f9dec8bfe2831a2b27e7797b8b57fe3d28

SHA256
ced9197f6e858ba488094b1ee3fe8942dd3675613d1920ce6a835aad7e319035

SHA512
7df5b8378cbb483e2edd0ff76bb13e1a760d259b5c1b6ddd18007052df1f903347a905b64566a2e4a270ca6b6f5d6bf271100e5f502ae1d39900ca3377522009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9

Filesize
248B

MD5
d75695edc990d893cff1ff4173408cac

SHA1
9aef056f1d6cbd1a689474818df001fdfb16a286

SHA256
e72b1e0421197d33754b08dcb83017ae36c565465f2d47865fbb7299ede4cd72

SHA512
fc848046facbe8416e657f1526090584adaeaeb1b2d27fef9b1519477946832c718783f64ed7c478be6f991645cd6208d8cea462b038732558326afb206263b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\889ddf7c-911a-4037-81f3-75d63b378d11\1cf298ca-7f46-4288-ad05-1c70ede1be67.exe

Filesize
2.6MB

MD5
df4c8d0e98e86ec434ff4e8416355ffc

SHA1
92ca94a3e7d5d2ebadeef424c962b4a254bf9c0a

SHA256
9dbc253908010bad0656634f55da3b9939e2d8ce9889156f643eead673ba4f60

SHA512
0e987cd3ce5cc87e779be8f0ded05c59e9674655b6dcb5c9e5f90aa57b0d13d1fe6f09c9062e4775c685628245126f7715308e16ca21e0e907845d9ac737b85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\889ddf7c-911a-4037-81f3-75d63b378d11\1cf298ca-7f46-4288-ad05-1c70ede1be67.exe

Filesize
2.6MB

MD5
df4c8d0e98e86ec434ff4e8416355ffc

SHA1
92ca94a3e7d5d2ebadeef424c962b4a254bf9c0a

SHA256
9dbc253908010bad0656634f55da3b9939e2d8ce9889156f643eead673ba4f60

SHA512
0e987cd3ce5cc87e779be8f0ded05c59e9674655b6dcb5c9e5f90aa57b0d13d1fe6f09c9062e4775c685628245126f7715308e16ca21e0e907845d9ac737b85a

Download Submit
C:\Users\Admin\Downloads\cgsetup_en_52GyYvig6QSzND3sbkgg.exe

Filesize
86KB

MD5
089263948175a716ac2db72f39f7572b

SHA1
7c98e155c4dffdb21f7ad09d1b338540f74161ee

SHA256
191c60d67d28e545303e84b5480a1708b844732698f6791d3f50a3d4ac034493

SHA512
84ed1204466d0da200fc4ee28771f2b8973df86b01988246cc4c41b4b514b9893f325a48a0d63edaad99ec2ac097244afbffe4d71e5f14c0fca2910e93606fec

Download Submit
C:\Users\Admin\Downloads\cgsetup_en_52GyYvig6QSzND3sbkgg.exe

Filesize
86KB

MD5
089263948175a716ac2db72f39f7572b

SHA1
7c98e155c4dffdb21f7ad09d1b338540f74161ee

SHA256
191c60d67d28e545303e84b5480a1708b844732698f6791d3f50a3d4ac034493

SHA512
84ed1204466d0da200fc4ee28771f2b8973df86b01988246cc4c41b4b514b9893f325a48a0d63edaad99ec2ac097244afbffe4d71e5f14c0fca2910e93606fec

Download Submit
memory/744-298-0x0000000000000000-mapping.dmp

Download
memory/932-233-0x00000298E96C0000-0x00000298E96D0000-memory.dmp

Filesize
64KB

Download
memory/932-179-0x00000298E8B30000-0x00000298E8B66000-memory.dmp

Filesize
216KB

Download
memory/932-167-0x0000000000000000-mapping.dmp

Download
memory/932-208-0x00000298E94D0000-0x00000298E950E000-memory.dmp

Filesize
248KB

Download
memory/932-214-0x00000298E9570000-0x00000298E95CA000-memory.dmp

Filesize
360KB

Download
memory/932-196-0x00000298E9140000-0x00000298E9152000-memory.dmp

Filesize
72KB

Download
memory/932-171-0x00000298CD7F0000-0x00000298CD944000-memory.dmp

Filesize
1.3MB

Download
memory/932-173-0x00000298E8BD0000-0x00000298E8C70000-memory.dmp

Filesize
640KB

Download
memory/932-227-0x00000298E9550000-0x00000298E9560000-memory.dmp

Filesize
64KB

Download
memory/932-175-0x00000298CF510000-0x00000298CF546000-memory.dmp

Filesize
216KB

Download
memory/932-228-0x00000298E9560000-0x00000298E9570000-memory.dmp

Filesize
64KB

Download
memory/932-226-0x00000298E9540000-0x00000298E9550000-memory.dmp

Filesize
64KB

Download
memory/932-177-0x00000298E8D60000-0x00000298E8DFA000-memory.dmp

Filesize
616KB

Download
memory/932-192-0x00000298CDCD0000-0x00000298CDCD8000-memory.dmp

Filesize
32KB

Download
memory/932-229-0x00000298E9680000-0x00000298E968E000-memory.dmp

Filesize
56KB

Download
memory/932-181-0x00000298E8EB0000-0x00000298E8F60000-memory.dmp

Filesize
704KB

Download
memory/932-230-0x00000298E9690000-0x00000298E96A0000-memory.dmp

Filesize
64KB

Download
memory/932-183-0x00000298CF580000-0x00000298CF5A6000-memory.dmp

Filesize
152KB

Download
memory/932-231-0x00000298E96A0000-0x00000298E96B0000-memory.dmp

Filesize
64KB

Download
memory/932-232-0x00000298E96B0000-0x00000298E96C0000-memory.dmp

Filesize
64KB

Download
memory/932-185-0x00000298CF5B0000-0x00000298CF5CA000-memory.dmp

Filesize
104KB

Download
memory/932-234-0x00000298E96F0000-0x00000298E9702000-memory.dmp

Filesize
72KB

Download
memory/932-187-0x00000298E8E00000-0x00000298E8E2C000-memory.dmp

Filesize
176KB

Download
memory/932-194-0x00000298E8BC0000-0x00000298E8BCE000-memory.dmp

Filesize
56KB

Download
memory/932-189-0x00000298E8E30000-0x00000298E8E4C000-memory.dmp

Filesize
112KB

Download
memory/932-190-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-140-0x000000001CEE0000-0x000000001D0A2000-memory.dmp

Filesize
1.8MB

Download
memory/1216-141-0x000000001D5E0000-0x000000001DB08000-memory.dmp

Filesize
5.2MB

Download
memory/1216-135-0x0000000000000000-mapping.dmp

Download
memory/1216-147-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1216-138-0x0000000000590000-0x00000000005A8000-memory.dmp

Filesize
96KB

Download
memory/1216-139-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1340-204-0x00000238D77F0000-0x00000238D782C000-memory.dmp

Filesize
240KB

Download
memory/1340-205-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1340-201-0x00000238BD3C0000-0x00000238BD3D4000-memory.dmp

Filesize
80KB

Download
memory/1340-198-0x0000000000000000-mapping.dmp

Download
memory/1340-202-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/1340-203-0x00000238BD720000-0x00000238BD732000-memory.dmp

Filesize
72KB

Download
memory/2016-326-0x0000000000000000-mapping.dmp

Download
memory/2380-133-0x0000000000000000-mapping.dmp

Download
memory/2652-327-0x0000000000000000-mapping.dmp

Download
memory/2660-220-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/2660-217-0x0000000000000000-mapping.dmp

Download
memory/2660-218-0x0000000000680000-0x00000000006EC000-memory.dmp

Filesize
432KB

Download
memory/2776-293-0x0000000000000000-mapping.dmp

Download
memory/3168-134-0x0000000000000000-mapping.dmp

Download
memory/3560-225-0x000001CD9F8F0000-0x000001CD9F914000-memory.dmp

Filesize
144KB

Download
memory/3560-221-0x000001CD9FD60000-0x000001CD9FE18000-memory.dmp

Filesize
736KB

Download
memory/3560-210-0x000001CD9EDD0000-0x000001CD9EDDC000-memory.dmp

Filesize
48KB

Download
memory/3560-215-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/3560-212-0x000001CD9EE60000-0x000001CD9EED2000-memory.dmp

Filesize
456KB

Download
memory/3560-224-0x000001CDA0C40000-0x000001CDA0D08000-memory.dmp

Filesize
800KB

Download
memory/3560-223-0x000001CD9F8C0000-0x000001CD9F8E2000-memory.dmp

Filesize
136KB

Download
memory/3560-219-0x000001CD9F820000-0x000001CD9F854000-memory.dmp

Filesize
208KB

Download
memory/3560-222-0x000001CD9F890000-0x000001CD9F8BE000-memory.dmp

Filesize
184KB

Download
memory/4304-328-0x0000000000000000-mapping.dmp

Download
memory/4336-151-0x0000028F25B40000-0x0000028F25B48000-memory.dmp

Filesize
32KB

Download
memory/4336-149-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4336-162-0x0000028F288B0000-0x0000028F288B8000-memory.dmp

Filesize
32KB

Download
memory/4336-160-0x0000028F28890000-0x0000028F28898000-memory.dmp

Filesize
32KB

Download
memory/4336-163-0x0000028F288C0000-0x0000028F288CA000-memory.dmp

Filesize
40KB

Download
memory/4336-159-0x0000028F287B0000-0x0000028F287B8000-memory.dmp

Filesize
32KB

Download
memory/4336-158-0x0000028F28790000-0x0000028F2879A000-memory.dmp

Filesize
40KB

Download
memory/4336-157-0x00007FF8932F0000-0x00007FF893DB1000-memory.dmp

Filesize
10.8MB

Download
memory/4336-156-0x0000028F28380000-0x0000028F28392000-memory.dmp

Filesize
72KB

Download
memory/4336-155-0x0000028F28220000-0x0000028F28228000-memory.dmp

Filesize
32KB

Download
memory/4336-154-0x0000028F28240000-0x0000028F28262000-memory.dmp

Filesize
136KB

Download
memory/4336-153-0x0000028F28150000-0x0000028F2815E000-memory.dmp

Filesize
56KB

Download
memory/4336-152-0x0000028F28190000-0x0000028F281C8000-memory.dmp

Filesize
224KB

Download
memory/4336-165-0x0000028F29740000-0x0000028F29790000-memory.dmp

Filesize
320KB

Download
memory/4336-144-0x0000000000000000-mapping.dmp

Download
memory/4336-166-0x0000028F29810000-0x0000028F29886000-memory.dmp

Filesize
472KB

Download
memory/4336-148-0x0000028F07750000-0x0000028F079F4000-memory.dmp

Filesize
2.6MB

Download
memory/4336-161-0x0000028F288A0000-0x0000028F288A8000-memory.dmp

Filesize
32KB

Download
memory/4336-150-0x0000028F25B30000-0x0000028F25B38000-memory.dmp

Filesize
32KB

Download
memory/4436-323-0x0000000000000000-mapping.dmp

Download
memory/5192-274-0x0000000000000000-mapping.dmp

Download
memory/5212-304-0x0000000000000000-mapping.dmp

Download
memory/5232-275-0x0000000000000000-mapping.dmp

Download
memory/5268-294-0x0000000000000000-mapping.dmp

Download
memory/5284-276-0x0000000000000000-mapping.dmp

Download
memory/5392-277-0x0000000000000000-mapping.dmp

Download
memory/5424-278-0x0000000000000000-mapping.dmp

Download
memory/5440-299-0x0000000000000000-mapping.dmp

Download
memory/5468-325-0x0000000000000000-mapping.dmp

Download
memory/5528-305-0x0000000000000000-mapping.dmp

Download
memory/5608-281-0x0000000000000000-mapping.dmp

Download
memory/5680-301-0x0000000000000000-mapping.dmp

Download
memory/5704-282-0x0000000000000000-mapping.dmp

Download
memory/5820-283-0x0000000000000000-mapping.dmp

Download
memory/5868-284-0x0000000000000000-mapping.dmp

Download
memory/5936-286-0x0000000000000000-mapping.dmp

Download
memory/6016-288-0x0000000000000000-mapping.dmp

Download
memory/6044-289-0x0000000000000000-mapping.dmp

Download