Analysis
-
max time kernel
341s -
max time network
310s -
platform
windows11-21h2_x64 -
resource
win11-20231129-en -
resource tags
arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system -
submitted
06-12-2023 22:51
Static task
static1
General
-
Target
!@#Setup-Pa$$W0rd-2024/@#Setup-Pa$$W0rd-2024.rar
-
Size
18.5MB
-
MD5
0aeb13bb3dd0d2761e3966625faac892
-
SHA1
a12b4adbb104ca945d248697753b4acbf054f157
-
SHA256
0a52968fe93ad0cfde0d408dbc7e0a77c54ab01fbcc280dd4a1b3b3897c79fce
-
SHA512
20de52f3c358735ffedcd068a1ea07d8bc66705e524362bd6c1dd1e81636b7f664b7e9d23239441d98dfcff8cbd48a2a6b0ff3bd0c5cede95acdcefdc407a34e
-
SSDEEP
393216:ZvYV/q2OHdyVYb7VlVEH+odXdun4eSznP/TTzI+B8TaTw2bcuphXe:BYV6QVYbvVwNdun4Db38+B8eTwoz/O
Malware Config
Extracted
amadey
4.13
http://185.172.128.125
-
install_dir
4fdb51ccdc
-
install_file
Utsysc.exe
-
strings_key
a70b05054314f381be1ab9a5cdc8b250
-
url_paths
/u6vhSc3PPq/index.php
Extracted
lumma
http://gatelistcoldyeisa.pw/api
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
tgtejjbuvj.exedescription pid process target process PID 4960 created 4532 4960 tgtejjbuvj.exe Pre-Activated-Setup.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs
Processes:
XRJNZC.exevwiwmdednsiaq.exeXRJNZC.exeUtsysc.exeUtsysc.exeUtsysc.exeXRJNZC.exeUtsysc.exeXRJNZC.exeUtsysc.exeXRJNZC.exeopfqwnhjfcqurgmq.exeUtsysc.exeXRJNZC.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XRJNZC.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ vwiwmdednsiaq.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XRJNZC.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Utsysc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Utsysc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Utsysc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XRJNZC.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Utsysc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XRJNZC.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Utsysc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XRJNZC.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ opfqwnhjfcqurgmq.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Utsysc.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ XRJNZC.exe -
XMRig Miner payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2488-151-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2488-152-0x0000000140000000-0x0000000140840000-memory.dmp xmrig behavioral1/memory/2488-153-0x0000000140000000-0x0000000140840000-memory.dmp xmrig -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 28 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
opfqwnhjfcqurgmq.exeXRJNZC.exeUtsysc.exevwiwmdednsiaq.exeXRJNZC.exeUtsysc.exeUtsysc.exeUtsysc.exeUtsysc.exeUtsysc.exeXRJNZC.exeXRJNZC.exeXRJNZC.exeXRJNZC.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion opfqwnhjfcqurgmq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vwiwmdednsiaq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion opfqwnhjfcqurgmq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Utsysc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XRJNZC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vwiwmdednsiaq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XRJNZC.exe -
Executes dropped EXE 11 IoCs
Processes:
Pre-Activated-Setup.exetgtejjbuvj.exeliveupdate.exevwiwmdednsiaq.exeopfqwnhjfcqurgmq.exeXRJNZC.exeXRJNZC.exeXRJNZC.exeXRJNZC.exeXRJNZC.exeXRJNZC.exepid process 4532 Pre-Activated-Setup.exe 4960 tgtejjbuvj.exe 3496 liveupdate.exe 792 vwiwmdednsiaq.exe 2424 opfqwnhjfcqurgmq.exe 3564 XRJNZC.exe 4264 XRJNZC.exe 3116 XRJNZC.exe 4576 XRJNZC.exe 3984 XRJNZC.exe 416 XRJNZC.exe -
Loads dropped DLL 1 IoCs
Processes:
liveupdate.exepid process 3496 liveupdate.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe themida C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe themida behavioral1/memory/792-50-0x00000000004E0000-0x0000000000EF7000-memory.dmp themida behavioral1/memory/792-54-0x00000000004E0000-0x0000000000EF7000-memory.dmp themida behavioral1/memory/792-55-0x00000000004E0000-0x0000000000EF7000-memory.dmp themida behavioral1/memory/792-56-0x00000000004E0000-0x0000000000EF7000-memory.dmp themida behavioral1/memory/792-57-0x00000000004E0000-0x0000000000EF7000-memory.dmp themida behavioral1/memory/792-58-0x00000000004E0000-0x0000000000EF7000-memory.dmp themida behavioral1/memory/792-64-0x00000000004E0000-0x0000000000EF7000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\opfqwnhjfcqurgmq.exe themida behavioral1/memory/2424-70-0x00000000008C0000-0x00000000011C9000-memory.dmp themida behavioral1/memory/2424-71-0x00000000008C0000-0x00000000011C9000-memory.dmp themida behavioral1/memory/3780-72-0x0000000000730000-0x0000000001039000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida behavioral1/memory/3780-78-0x0000000000730000-0x0000000001039000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida behavioral1/memory/3780-80-0x0000000000730000-0x0000000001039000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida behavioral1/memory/3564-82-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/3564-85-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/3564-89-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/3564-92-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/3780-93-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3564-94-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/3780-90-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3780-87-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3780-84-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3564-83-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/3780-81-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3780-95-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3564-96-0x0000000000F90000-0x00000000019A7000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida behavioral1/memory/4264-113-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/1620-114-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/4264-122-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/4264-123-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/1620-124-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/1620-125-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/1620-126-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/4264-127-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/1620-128-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/1620-129-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/1620-130-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/1620-131-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/4264-133-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/4264-132-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/1620-134-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/4264-136-0x0000000000F90000-0x00000000019A7000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida behavioral1/memory/3044-191-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3044-211-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/3116-214-0x0000000000F90000-0x00000000019A7000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida behavioral1/memory/4784-248-0x0000000000730000-0x0000000001039000-memory.dmp themida behavioral1/memory/4576-251-0x0000000000F90000-0x00000000019A7000-memory.dmp themida behavioral1/memory/2068-271-0x0000000000730000-0x0000000001039000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida behavioral1/memory/2068-293-0x0000000000730000-0x0000000001039000-memory.dmp themida C:\ProgramData\pinterests\XRJNZC.exe themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
XRJNZC.exeXRJNZC.exeXRJNZC.exeXRJNZC.exevwiwmdednsiaq.exeopfqwnhjfcqurgmq.exeXRJNZC.exeXRJNZC.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XRJNZC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XRJNZC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XRJNZC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XRJNZC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vwiwmdednsiaq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA opfqwnhjfcqurgmq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XRJNZC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XRJNZC.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
vwiwmdednsiaq.exeUtsysc.exeXRJNZC.exeUtsysc.exeXRJNZC.exeXRJNZC.exeUtsysc.exeUtsysc.exeXRJNZC.exeXRJNZC.exeUtsysc.exeUtsysc.exeXRJNZC.exepid process 792 vwiwmdednsiaq.exe 3780 Utsysc.exe 3564 XRJNZC.exe 1620 Utsysc.exe 4264 XRJNZC.exe 3116 XRJNZC.exe 3044 Utsysc.exe 4784 Utsysc.exe 4576 XRJNZC.exe 3984 XRJNZC.exe 2068 Utsysc.exe 768 Utsysc.exe 416 XRJNZC.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
liveupdate.execertutil.exedescription pid process target process PID 3496 set thread context of 3684 3496 liveupdate.exe cmd.exe PID 5100 set thread context of 2488 5100 certutil.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1400 schtasks.exe 5020 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4452 timeout.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 64 IoCs
Processes:
cmd.exeOpenWith.exeexplorer.exeBackgroundTransferHost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings cmd.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Applications\7zFM.exe\shell\open\command OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Applications\7zFM.exe\shell OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\둑ǡ\ = "rar_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\ꟙ翿\ = "rar_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\.rar\ = "rar_auto_file" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000007d5794821000372d5a6970003c0009000400efbe7d5794827d5794822e000000058d02000000050000000000000000000000000000007c8f2f0037002d005a0069007000000014000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000007d57c784110050524f4752417e310000740009000400efbec55259617d57c7842e0000003f0000000000010000000000000000004a0000000000e8c05e00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\rar_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\䖼॰鐀dummy\ = "rar_auto_file" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 1e00718000000000000000000000e1a40ed25739d211a40b0c50205241530000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\rar_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\rar_auto_file\shell OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "287309825" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\둑ǡ OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 OpenWith.exe Set value (int) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Key created \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-89531631-1347641568-3714596404-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 3248 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
explorer.exepid process 1292 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7zFM.exePre-Activated-Setup.exetgtejjbuvj.exeliveupdate.exevwiwmdednsiaq.exeUtsysc.exeXRJNZC.execmd.exeUtsysc.exeXRJNZC.execertutil.exeexplorer.exetaskmgr.exepid process 1588 7zFM.exe 1588 7zFM.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4532 Pre-Activated-Setup.exe 4960 tgtejjbuvj.exe 4960 tgtejjbuvj.exe 3496 liveupdate.exe 792 vwiwmdednsiaq.exe 792 vwiwmdednsiaq.exe 3780 Utsysc.exe 3780 Utsysc.exe 3564 XRJNZC.exe 3564 XRJNZC.exe 3684 cmd.exe 3684 cmd.exe 1620 Utsysc.exe 1620 Utsysc.exe 4264 XRJNZC.exe 4264 XRJNZC.exe 5100 certutil.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 2488 explorer.exe 1948 taskmgr.exe 1948 taskmgr.exe 2488 explorer.exe 2488 explorer.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
Processes:
OpenWith.exe7zFM.exetaskmgr.exepid process 1372 OpenWith.exe 1588 7zFM.exe 1948 taskmgr.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
liveupdate.execmd.exepid process 3496 liveupdate.exe 3684 cmd.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
7zFM.exeexplorer.execontrol.exetaskmgr.exeAUDIODG.EXEdescription pid process Token: SeRestorePrivilege 1588 7zFM.exe Token: 35 1588 7zFM.exe Token: SeSecurityPrivilege 1588 7zFM.exe Token: SeSecurityPrivilege 1588 7zFM.exe Token: SeLockMemoryPrivilege 2488 explorer.exe Token: SeLockMemoryPrivilege 2488 explorer.exe Token: SeShutdownPrivilege 1960 control.exe Token: SeCreatePagefilePrivilege 1960 control.exe Token: SeDebugPrivilege 1948 taskmgr.exe Token: SeSystemProfilePrivilege 1948 taskmgr.exe Token: SeCreateGlobalPrivilege 1948 taskmgr.exe Token: SeSecurityPrivilege 1948 taskmgr.exe Token: SeTakeOwnershipPrivilege 1948 taskmgr.exe Token: SeSecurityPrivilege 1948 taskmgr.exe Token: SeTakeOwnershipPrivilege 1948 taskmgr.exe Token: 33 1476 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1476 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
7zFM.exeexplorer.exetaskmgr.exepid process 1588 7zFM.exe 1588 7zFM.exe 1588 7zFM.exe 1588 7zFM.exe 1292 explorer.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe 1948 taskmgr.exe -
Suspicious use of SetWindowsHookEx 25 IoCs
Processes:
OpenWith.exeosk.exepid process 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1372 OpenWith.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe 1764 osk.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
OpenWith.exe7zFM.exePre-Activated-Setup.exetgtejjbuvj.exeliveupdate.exevwiwmdednsiaq.execmd.exeXRJNZC.exeUtsysc.execmd.execertutil.exeexplorer.exedescription pid process target process PID 1372 wrote to memory of 1588 1372 OpenWith.exe 7zFM.exe PID 1372 wrote to memory of 1588 1372 OpenWith.exe 7zFM.exe PID 1588 wrote to memory of 3248 1588 7zFM.exe NOTEPAD.EXE PID 1588 wrote to memory of 3248 1588 7zFM.exe NOTEPAD.EXE PID 4532 wrote to memory of 4960 4532 Pre-Activated-Setup.exe tgtejjbuvj.exe PID 4532 wrote to memory of 4960 4532 Pre-Activated-Setup.exe tgtejjbuvj.exe PID 4532 wrote to memory of 4960 4532 Pre-Activated-Setup.exe tgtejjbuvj.exe PID 4960 wrote to memory of 3496 4960 tgtejjbuvj.exe liveupdate.exe PID 4960 wrote to memory of 3496 4960 tgtejjbuvj.exe liveupdate.exe PID 4960 wrote to memory of 3496 4960 tgtejjbuvj.exe liveupdate.exe PID 3496 wrote to memory of 3684 3496 liveupdate.exe cmd.exe PID 3496 wrote to memory of 3684 3496 liveupdate.exe cmd.exe PID 3496 wrote to memory of 3684 3496 liveupdate.exe cmd.exe PID 4532 wrote to memory of 792 4532 Pre-Activated-Setup.exe vwiwmdednsiaq.exe PID 4532 wrote to memory of 792 4532 Pre-Activated-Setup.exe vwiwmdednsiaq.exe PID 4532 wrote to memory of 792 4532 Pre-Activated-Setup.exe vwiwmdednsiaq.exe PID 792 wrote to memory of 3872 792 vwiwmdednsiaq.exe cmd.exe PID 792 wrote to memory of 3872 792 vwiwmdednsiaq.exe cmd.exe PID 792 wrote to memory of 3872 792 vwiwmdednsiaq.exe cmd.exe PID 3872 wrote to memory of 4452 3872 cmd.exe timeout.exe PID 3872 wrote to memory of 4452 3872 cmd.exe timeout.exe PID 3872 wrote to memory of 4452 3872 cmd.exe timeout.exe PID 4532 wrote to memory of 2424 4532 Pre-Activated-Setup.exe opfqwnhjfcqurgmq.exe PID 4532 wrote to memory of 2424 4532 Pre-Activated-Setup.exe opfqwnhjfcqurgmq.exe PID 4532 wrote to memory of 2424 4532 Pre-Activated-Setup.exe opfqwnhjfcqurgmq.exe PID 3872 wrote to memory of 3564 3872 cmd.exe XRJNZC.exe PID 3872 wrote to memory of 3564 3872 cmd.exe XRJNZC.exe PID 3872 wrote to memory of 3564 3872 cmd.exe XRJNZC.exe PID 3564 wrote to memory of 1400 3564 XRJNZC.exe schtasks.exe PID 3564 wrote to memory of 1400 3564 XRJNZC.exe schtasks.exe PID 3564 wrote to memory of 1400 3564 XRJNZC.exe schtasks.exe PID 3780 wrote to memory of 5020 3780 Utsysc.exe schtasks.exe PID 3780 wrote to memory of 5020 3780 Utsysc.exe schtasks.exe PID 3780 wrote to memory of 5020 3780 Utsysc.exe schtasks.exe PID 3496 wrote to memory of 3684 3496 liveupdate.exe cmd.exe PID 3684 wrote to memory of 5100 3684 cmd.exe certutil.exe PID 3684 wrote to memory of 5100 3684 cmd.exe certutil.exe PID 3684 wrote to memory of 5100 3684 cmd.exe certutil.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 5100 wrote to memory of 2488 5100 certutil.exe explorer.exe PID 1292 wrote to memory of 1948 1292 explorer.exe taskmgr.exe PID 1292 wrote to memory of 1948 1292 explorer.exe taskmgr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\!@#Setup-Pa$$W0rd-2024\@#Setup-Pa$$W0rd-2024.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\!@#Setup-Pa$$W0rd-2024\@#Setup-Pa$$W0rd-2024.rar"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO43643538\Readme.txt3⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\Pre-Activated-Setup.exe"C:\Users\Admin\Desktop\Pre-Activated-Setup.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exe"C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exeC:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\certutil.exeC:\Windows\System32\certutil.exe4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe"C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sm0.0.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
C:\ProgramData\pinterests\XRJNZC.exe"C:\ProgramData\pinterests\XRJNZC.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr C:\ProgramData\pinterests\XRJNZC.exe /f5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\opfqwnhjfcqurgmq.exe"C:\Users\Admin\AppData\Local\Temp\opfqwnhjfcqurgmq.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F4⤵
- Creates scheduled task(s)
-
C:\ProgramData\pinterests\XRJNZC.exeC:\ProgramData\pinterests\XRJNZC.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
-
C:\ProgramData\pinterests\XRJNZC.exeC:\ProgramData\pinterests\XRJNZC.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\pinterests\XRJNZC.exeC:\ProgramData\pinterests\XRJNZC.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
-
C:\Windows\system32\osk.exe"C:\Windows\system32\osk.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\pinterests\XRJNZC.exeC:\ProgramData\pinterests\XRJNZC.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004E81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\pinterests\XRJNZC.exeC:\ProgramData\pinterests\XRJNZC.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exeC:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\ProgramData\pinterests\XRJNZC.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
14KB
MD5e65e7ff6ba63da8b41a49e3d4906066a
SHA153ee0a22d55a7a488925736f39e018db85bd0510
SHA256244435383e08928ab492d0c941bc91b255d91adb69ce74b4b9532f8c3503836e
SHA51278d0efa6b7e8e416f46643b3a070ef36450cb2fb027c57956ce57b7fd189187e50d493aea79a05b8e8d62a117c1f1f29d01b00e109b9f0c6a0ecb50cbcff5049
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
28KB
MD54630bad8d35746d5aea98d350848eb99
SHA1f685a9a40883e789462491e07f2daaf5db1219df
SHA2561e4130e0514ed3dec7407423ee2ae5c0fb2e6fa1f391cb57a14d34c676e65e4b
SHA5122325640b20d98278e03d3b65f81bc1c98861f582e8e4161f8b2ea7d5e7f6ee17c7eaaa13495f910e8b1ddf8f9fb0a0bc3b859041c0c7f08490d2b9429034e854
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
14KB
MD53cf2f0c869120d7163c6d036497213bf
SHA1ac6cf14bdaedbb55506448bec8e7478f5624a568
SHA256d872e517631e428eebe1c49bd1d3f5a6bbf8f55d7fbabe5ed37042de787143c1
SHA512acd66e3cb66fd711262cf18495838412e4797196efd92302ccb84a10312f18bd06082d58bfa11ed2933fccd09d3d35e3a1c95c56ae1b6728752f7dd77e458179
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\828d4825-9e30-4137-8add-269b8b9e22d6.down_dataFilesize
555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
C:\Users\Admin\AppData\Local\Temp\58e99d85Filesize
7.5MB
MD58f7df2caa83cfcfa5d895539f1f37240
SHA10321048b46538ef61cac6d3f06e6203009b4678b
SHA25620fae317a54871fe0dad70c86c1c55197cb369a3ab7e2af70a807232b29b8d5e
SHA51268a9e19873ce86b441853d2b396a975c1f214542b89a7dad75a1d996b73dbb63c1afac9e99771ad961ca06e354aa32a0ac4c8ee2e43aae4018921ea90c1c62ae
-
C:\Users\Admin\AppData\Local\Temp\7zO43643538\Readme.txtFilesize
116B
MD5aeaa412966cbe5d05a83d1ac60c5fc84
SHA1c6b340a85fb59a156e57d1fa56ebeeb8d3e99cbb
SHA256d5cdee14fed046a1bd4ac755861ca2391a7604a8ef0056ce5a97f83e0f653910
SHA512cbd73c31cfce4d8015bf9028b3a950602c35777095dcedc571dffabc08a1f2ec16045a743f17b3db7b64bfa0e2e213765c3be6ceac258ee495d1baac3c556367
-
C:\Users\Admin\AppData\Local\Temp\opfqwnhjfcqurgmq.exeFilesize
3.3MB
MD51f912c12896eb6942bd3f067d47b9250
SHA18925008534a6149eaf6c47182cb7e1d89ed59471
SHA2563de42e8dcad7071ee556ce2ac67ec15f829ee2aa25b93afdedbf4fe9ec56b90b
SHA512682cd0638af81715232d6bc8fd7b1378d97d99595ef396d536f2b605e12d7ab162b50acfc09c94f039114e7307d8076f7cc5098a149e98e35b40f4dbeaffb5ce
-
C:\Users\Admin\AppData\Local\Temp\sm0.0.batFilesize
174B
MD5ea48ee25a6caa5b2b606e4d08c41f536
SHA1cf5e6756fac08841c136db93817d216137279641
SHA256e1e92ff2df302c0d72babe33e840ab36ee346ef9a51df5b44ba0e05bc3f259cc
SHA512a58db6d7390db645941453ac9302b2040fa5efb1af53ca3d12f1b4109720a5647495d83860f262d43b4a139bbc238d58ae50a84e0c009baae3f8836dc42c309f
-
C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exeFilesize
9.7MB
MD558d28558b5e2ffbb0238ed852b0fccf4
SHA188ce8d1c7a152d5b1095d0ace8815c597111454e
SHA256ab636afce7424bcbdc93485835088b2594011df6a55346cde38fb6d3423eb820
SHA5124607a9b40e0878bc06e5bc3c925e434b31ff3d70fa3257555b3a44b51bb011cd6e6aef9eae61cc472c33b3593a54f784c999ef8df71e452ae666b85d3e57b72b
-
C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exeFilesize
9.7MB
MD558d28558b5e2ffbb0238ed852b0fccf4
SHA188ce8d1c7a152d5b1095d0ace8815c597111454e
SHA256ab636afce7424bcbdc93485835088b2594011df6a55346cde38fb6d3423eb820
SHA5124607a9b40e0878bc06e5bc3c925e434b31ff3d70fa3257555b3a44b51bb011cd6e6aef9eae61cc472c33b3593a54f784c999ef8df71e452ae666b85d3e57b72b
-
C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exeFilesize
4.0MB
MD5bc6a35107c6d2cc2ec746897799b9164
SHA14063a434ec504cc5f808e766b21d0d32d43f5715
SHA2561a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939
SHA5124eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809
-
C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exeFilesize
485KB
MD56bf3b86782b7911b76029737162ae206
SHA11b8009865c79b5674734ba4ce9a6905bed78182e
SHA256535f67c47f811aa5b421904959dd6931396a52cdbb9ddb69bface741356dbbef
SHA512385291ef2ba36b39fd6c7c5af08ad9127d60685e28d69e55152341f522b79f2f4ca3c1aa9e13575dbce0699d976b34dbb5985d08495ca22dc20ed323b7d80ba1
-
C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exeFilesize
485KB
MD56bf3b86782b7911b76029737162ae206
SHA11b8009865c79b5674734ba4ce9a6905bed78182e
SHA256535f67c47f811aa5b421904959dd6931396a52cdbb9ddb69bface741356dbbef
SHA512385291ef2ba36b39fd6c7c5af08ad9127d60685e28d69e55152341f522b79f2f4ca3c1aa9e13575dbce0699d976b34dbb5985d08495ca22dc20ed323b7d80ba1
-
C:\Users\Admin\AppData\Roaming\wshom\log.dllFilesize
101KB
MD52fa3b395d39fb17762d35042153e9abf
SHA1a1972168b08a1fa8d6fe75dd493f30119c03514e
SHA256c12c8759549c64ef3002c0d0c5ce421632e98edb4e99175a2673af2bdcbd966f
SHA51247566fd4192e93e8cdce2444298a29c37aad09e72ec0393f44549e8b481be135b01a6a6c1caf71f92a54edb9cf72ab3d449a7fe51fd8bb60e9ec2d3710569549
-
C:\Users\Admin\AppData\Roaming\wshom\log.dllFilesize
101KB
MD52fa3b395d39fb17762d35042153e9abf
SHA1a1972168b08a1fa8d6fe75dd493f30119c03514e
SHA256c12c8759549c64ef3002c0d0c5ce421632e98edb4e99175a2673af2bdcbd966f
SHA51247566fd4192e93e8cdce2444298a29c37aad09e72ec0393f44549e8b481be135b01a6a6c1caf71f92a54edb9cf72ab3d449a7fe51fd8bb60e9ec2d3710569549
-
C:\Users\Admin\AppData\Roaming\wshom\xeroderma.wavFilesize
7.3MB
MD514e77d438d09d660687208291c5af2f4
SHA18ac0a010650253e967688eb73a406b40ca9b2570
SHA2565ab63c89abee93f6c1e7c93acc51c9419781cc063586ff8312bb9595555447e4
SHA512f34de0932bc2072de334f801f53abc4c603887e24d8d1eef25550afc1d2ee30a0200bc6d0295a1804cb07c312bdd782e89db19f6c9f51006e11ced359e71c1cd
-
C:\Users\Admin\Desktop\Pre-Activated-Setup.exeFilesize
782.7MB
MD5510ba4196536f9a9324ffc7e0fea1780
SHA1e00e081d1d1f158c1260c46902b3fb315097343a
SHA256aec98b350ff94f35932676e6d45d727544b3708829189b2312673b31828ccfb0
SHA51283214f8cdca64757e6f05ef9b9826a6f497494e334072eb5382ccb30590dddc61c7780ee1d3465fd004e9c5e7c6a9bc7e6f30b4e2f5c5b3084ae40ed8bad2c0a
-
C:\Users\Admin\Desktop\Pre-Activated-Setup.exeFilesize
782.7MB
MD5510ba4196536f9a9324ffc7e0fea1780
SHA1e00e081d1d1f158c1260c46902b3fb315097343a
SHA256aec98b350ff94f35932676e6d45d727544b3708829189b2312673b31828ccfb0
SHA51283214f8cdca64757e6f05ef9b9826a6f497494e334072eb5382ccb30590dddc61c7780ee1d3465fd004e9c5e7c6a9bc7e6f30b4e2f5c5b3084ae40ed8bad2c0a
-
memory/792-53-0x0000000077906000-0x0000000077908000-memory.dmpFilesize
8KB
-
memory/792-50-0x00000000004E0000-0x0000000000EF7000-memory.dmpFilesize
10.1MB
-
memory/792-55-0x00000000004E0000-0x0000000000EF7000-memory.dmpFilesize
10.1MB
-
memory/792-56-0x00000000004E0000-0x0000000000EF7000-memory.dmpFilesize
10.1MB
-
memory/792-57-0x00000000004E0000-0x0000000000EF7000-memory.dmpFilesize
10.1MB
-
memory/792-58-0x00000000004E0000-0x0000000000EF7000-memory.dmpFilesize
10.1MB
-
memory/792-64-0x00000000004E0000-0x0000000000EF7000-memory.dmpFilesize
10.1MB
-
memory/792-52-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/792-66-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/792-51-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/792-54-0x00000000004E0000-0x0000000000EF7000-memory.dmpFilesize
10.1MB
-
memory/1620-135-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/1620-125-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-114-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-116-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/1620-117-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/1620-134-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-119-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/1620-131-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-130-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-124-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-129-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-128-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/1620-126-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/2068-278-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/2068-276-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/2068-273-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/2068-271-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/2068-293-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/2424-71-0x00000000008C0000-0x00000000011C9000-memory.dmpFilesize
9.0MB
-
memory/2424-70-0x00000000008C0000-0x00000000011C9000-memory.dmpFilesize
9.0MB
-
memory/2488-151-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2488-153-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2488-149-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/2488-168-0x00000000020D0000-0x00000000020F0000-memory.dmpFilesize
128KB
-
memory/2488-152-0x0000000140000000-0x0000000140840000-memory.dmpFilesize
8.2MB
-
memory/3044-213-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3044-197-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3044-195-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3044-191-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3044-211-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3116-215-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3116-214-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3116-196-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3116-194-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3496-42-0x0000000000A60000-0x0000000000AE0000-memory.dmpFilesize
512KB
-
memory/3496-45-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/3496-43-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/3496-98-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/3496-44-0x00007FFFA8E60000-0x00007FFFA9069000-memory.dmpFilesize
2.0MB
-
memory/3564-92-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3564-83-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3564-94-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3564-88-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3564-111-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3564-110-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3564-108-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3564-79-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3564-82-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3564-91-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3564-89-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3564-85-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3564-96-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/3684-139-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/3684-100-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/3684-102-0x00007FFFA8E60000-0x00007FFFA9069000-memory.dmpFilesize
2.0MB
-
memory/3684-142-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/3684-140-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/3780-90-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-106-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3780-77-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3780-84-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-109-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3780-72-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-81-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-80-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-95-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-87-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-86-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3780-76-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3780-78-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-93-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/3780-107-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3984-275-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3984-277-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/3984-279-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4264-127-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4264-132-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4264-120-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4264-113-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4264-121-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4264-122-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4264-123-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4264-118-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4264-136-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4264-137-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4264-133-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4532-19-0x00000000000C0000-0x00000000004FB000-memory.dmpFilesize
4.2MB
-
memory/4576-251-0x0000000000F90000-0x00000000019A7000-memory.dmpFilesize
10.1MB
-
memory/4576-233-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4576-234-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4576-252-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4784-249-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4784-248-0x0000000000730000-0x0000000001039000-memory.dmpFilesize
9.0MB
-
memory/4784-232-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4784-231-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4784-229-0x0000000076110000-0x0000000076200000-memory.dmpFilesize
960KB
-
memory/4960-39-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/4960-30-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/4960-28-0x00007FFFA8E60000-0x00007FFFA9069000-memory.dmpFilesize
2.0MB
-
memory/4960-27-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/4960-97-0x0000000074D90000-0x0000000074F0D000-memory.dmpFilesize
1.5MB
-
memory/4960-26-0x0000000000190000-0x0000000000A1E000-memory.dmpFilesize
8.6MB
-
memory/5100-145-0x00007FF7D6CC0000-0x00007FF7D73A2000-memory.dmpFilesize
6.9MB
-
memory/5100-150-0x00007FF7AF130000-0x00007FF7AF2B2000-memory.dmpFilesize
1.5MB