Analysis
-
max time kernel
300s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
22-04-2024 06:06
Static task
static1
Behavioral task
behavioral1
Sample
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe
Resource
win10-20240404-en
General
-
Target
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe
-
Size
1.8MB
-
MD5
052a6dbb20766b4a9edd5f68afa368e2
-
SHA1
ede425de400a9d85839bea075e650dd0c71bd20a
-
SHA256
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d
-
SHA512
bbd02be4257d183ad4baa1099b44a2fcf032219635e3ae203ed72d9f4d17893bf407e9b15903b22cde69499260a17b8c0729c2ff0a0c74e31177d844ff804fdf
-
SSDEEP
49152:HFZ+UiftMFlyNdJs6AXb7WqwjF4XWjYh/Zk07mOQM+fgAM:HFIyyNdOZX/WqgF4XW4BD7mOQ
Malware Config
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
LiveTraffic
4.184.225.183:30592
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe family_zgrat_v1 behavioral2/memory/1188-70-0x0000000000FE0000-0x000000000119C000-memory.dmp family_zgrat_v1 -
Glupteba payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4376-549-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
AppGate2103v01_16.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" AppGate2103v01_16.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe family_redline behavioral2/memory/4120-92-0x0000000000A30000-0x0000000000A82000-memory.dmp family_redline behavioral2/memory/5072-114-0x00000000002E0000-0x000000000036C000-memory.dmp family_redline behavioral2/memory/1136-135-0x0000000000400000-0x0000000000452000-memory.dmp family_redline behavioral2/memory/932-141-0x00000000001C0000-0x000000000023D000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline behavioral2/memory/3672-179-0x0000000000B50000-0x0000000000BA2000-memory.dmp family_redline -
Processes:
Uni400uni.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Uni400uni.exe -
Processes:
4767d2e713f2021e8fe856e3ea638b58.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4767d2e713f2021e8fe856e3ea638b58.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 4767d2e713f2021e8fe856e3ea638b58.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exechrosha.exeAppGate2103v01_16.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AppGate2103v01_16.exe -
Blocklisted process makes network request 3 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 81 440 rundll32.exe 87 2340 rundll32.exe 87 2340 rundll32.exe -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 5384 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
AppGate2103v01_16.exeffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exechrosha.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AppGate2103v01_16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AppGate2103v01_16.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe -
Executes dropped EXE 31 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exeTraffic.exepropro.exegold.exeNewB.exejok.exeISetup8.exeswiiii.exetoolspub1.exefile300un.exeu10c.0.exe4767d2e713f2021e8fe856e3ea638b58.exeFirstZ.exeUni400uni.exeQg_Appv5.exeu10c.1.exeptInst.exeptInst.exeAppGate2103v01_16.exe4767d2e713f2021e8fe856e3ea638b58.exereakuqnanrkn.exeNewB.execsrss.exeinjector.exewindefender.exewindefender.exeNewB.exeNewB.exeNewB.exepid process 3396 chrosha.exe 360 swiiiii.exe 1188 alexxxxxxxx.exe 5072 Traffic.exe 4120 propro.exe 932 gold.exe 5108 NewB.exe 3672 jok.exe 1308 ISetup8.exe 3728 swiiii.exe 4748 toolspub1.exe 3104 file300un.exe 4732 u10c.0.exe 4376 4767d2e713f2021e8fe856e3ea638b58.exe 612 FirstZ.exe 1188 Uni400uni.exe 4836 Qg_Appv5.exe 4432 u10c.1.exe 212 ptInst.exe 1244 ptInst.exe 3880 AppGate2103v01_16.exe 4904 4767d2e713f2021e8fe856e3ea638b58.exe 4804 reakuqnanrkn.exe 4296 NewB.exe 5588 csrss.exe 5304 injector.exe 5628 windefender.exe 5772 windefender.exe 5852 NewB.exe 5808 NewB.exe 5716 NewB.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exechrosha.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe Key opened \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Wine chrosha.exe -
Loads dropped DLL 11 IoCs
Processes:
rundll32.exerundll32.exeRegAsm.exeptInst.exerundll32.exeptInst.exepid process 1384 rundll32.exe 440 rundll32.exe 2524 RegAsm.exe 2524 RegAsm.exe 212 ptInst.exe 212 ptInst.exe 212 ptInst.exe 2340 rundll32.exe 1244 ptInst.exe 1244 ptInst.exe 1244 ptInst.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe themida behavioral2/memory/3880-550-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida behavioral2/memory/3880-551-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida behavioral2/memory/3880-552-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida behavioral2/memory/3880-557-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida behavioral2/memory/3880-554-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida behavioral2/memory/3880-559-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida behavioral2/memory/3880-561-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida behavioral2/memory/3880-564-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmp themida -
Processes:
4767d2e713f2021e8fe856e3ea638b58.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4767d2e713f2021e8fe856e3ea638b58.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 4767d2e713f2021e8fe856e3ea638b58.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4767d2e713f2021e8fe856e3ea638b58.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Uni400uni.exeAppGate2103v01_16.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Uni400uni.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AppGate2103v01_16.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Uni400uni.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 73 pastebin.com 74 pastebin.com 84 pastebin.com 122 pastebin.com 124 pastebin.com -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 92 api.myip.com 97 api.myip.com 98 ipinfo.io 99 ipinfo.io -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 15 IoCs
Processes:
FirstZ.exepowershell.exeAppGate2103v01_16.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exereakuqnanrkn.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe FirstZ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\GroupPolicy AppGate2103v01_16.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol AppGate2103v01_16.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini AppGate2103v01_16.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI AppGate2103v01_16.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe reakuqnanrkn.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exechrosha.exeAppGate2103v01_16.exepid process 2924 ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe 3396 chrosha.exe 3880 AppGate2103v01_16.exe -
Suspicious use of SetThreadContext 10 IoCs
Processes:
swiiiii.exealexxxxxxxx.exegold.exeswiiii.exefile300un.exeUni400uni.exeptInst.execmd.exereakuqnanrkn.exedescription pid process target process PID 360 set thread context of 2184 360 swiiiii.exe RegAsm.exe PID 1188 set thread context of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 932 set thread context of 1136 932 gold.exe RegAsm.exe PID 3728 set thread context of 2524 3728 swiiii.exe RegAsm.exe PID 3104 set thread context of 1348 3104 file300un.exe regsvcs.exe PID 1188 set thread context of 1936 1188 Uni400uni.exe regsvcs.exe PID 1244 set thread context of 5112 1244 ptInst.exe cmd.exe PID 5112 set thread context of 3284 5112 cmd.exe MSBuild.exe PID 4804 set thread context of 3568 4804 reakuqnanrkn.exe conhost.exe PID 4804 set thread context of 5996 4804 reakuqnanrkn.exe explorer.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
4767d2e713f2021e8fe856e3ea638b58.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 4767d2e713f2021e8fe856e3ea638b58.exe -
Drops file in Windows directory 5 IoCs
Processes:
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe4767d2e713f2021e8fe856e3ea638b58.execsrss.exedescription ioc process File created C:\Windows\Tasks\chrosha.job ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe File opened for modification C:\Windows\rss 4767d2e713f2021e8fe856e3ea638b58.exe File created C:\Windows\rss\csrss.exe 4767d2e713f2021e8fe856e3ea638b58.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 5440 sc.exe 2744 sc.exe 5864 sc.exe 5280 sc.exe 2944 sc.exe 5488 sc.exe 5896 sc.exe 6104 sc.exe 5308 sc.exe 6088 sc.exe 5412 sc.exe 1380 sc.exe 6048 sc.exe 4432 sc.exe 5404 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4204 360 WerFault.exe swiiiii.exe 1052 4748 WerFault.exe toolspub1.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
u10c.1.exetoolspub1.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u10c.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u10c.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u10c.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 232 schtasks.exe 524 schtasks.exe 2868 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
4767d2e713f2021e8fe856e3ea638b58.exepowershell.exewindefender.exepowershell.exenetsh.exepowershell.exepowershell.exepowershell.exeexplorer.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 4767d2e713f2021e8fe856e3ea638b58.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 4767d2e713f2021e8fe856e3ea638b58.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe -
Processes:
propro.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 propro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 propro.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exechrosha.exerundll32.exeRegAsm.exepropro.exeTraffic.exeUni400uni.exeQg_Appv5.exejok.exeptInst.exeptInst.exepowershell.exepowershell.exepowershell.execmd.exe4767d2e713f2021e8fe856e3ea638b58.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepid process 2924 ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe 2924 ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe 3396 chrosha.exe 3396 chrosha.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 2524 RegAsm.exe 2524 RegAsm.exe 4120 propro.exe 4120 propro.exe 5072 Traffic.exe 5072 Traffic.exe 1188 Uni400uni.exe 1188 Uni400uni.exe 4836 Qg_Appv5.exe 4836 Qg_Appv5.exe 4836 Qg_Appv5.exe 3672 jok.exe 3672 jok.exe 4120 propro.exe 4120 propro.exe 2524 RegAsm.exe 2524 RegAsm.exe 4836 Qg_Appv5.exe 4836 Qg_Appv5.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 440 rundll32.exe 212 ptInst.exe 1244 ptInst.exe 1244 ptInst.exe 1244 ptInst.exe 4444 powershell.exe 4444 powershell.exe 4444 powershell.exe 3032 powershell.exe 3032 powershell.exe 4444 powershell.exe 3032 powershell.exe 3672 jok.exe 3672 jok.exe 3032 powershell.exe 5464 powershell.exe 5464 powershell.exe 5464 powershell.exe 5112 cmd.exe 5112 cmd.exe 5112 cmd.exe 5112 cmd.exe 5464 powershell.exe 4376 4767d2e713f2021e8fe856e3ea638b58.exe 4376 4767d2e713f2021e8fe856e3ea638b58.exe 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
ptInst.execmd.exepid process 1244 ptInst.exe 5112 cmd.exe 5112 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Traffic.exeregsvcs.exepropro.exeUni400uni.exeregsvcs.exepowershell.exepowershell.exejok.exeRegAsm.exepowershell.exe4767d2e713f2021e8fe856e3ea638b58.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exepowershell.exepowershell.exepowercfg.exedescription pid process Token: SeDebugPrivilege 5072 Traffic.exe Token: SeBackupPrivilege 5072 Traffic.exe Token: SeSecurityPrivilege 5072 Traffic.exe Token: SeSecurityPrivilege 5072 Traffic.exe Token: SeSecurityPrivilege 5072 Traffic.exe Token: SeSecurityPrivilege 5072 Traffic.exe Token: SeDebugPrivilege 1348 regsvcs.exe Token: SeDebugPrivilege 4120 propro.exe Token: SeDebugPrivilege 1188 Uni400uni.exe Token: SeDebugPrivilege 1936 regsvcs.exe Token: SeDebugPrivilege 4444 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeDebugPrivilege 3672 jok.exe Token: SeIncreaseQuotaPrivilege 3032 powershell.exe Token: SeSecurityPrivilege 3032 powershell.exe Token: SeTakeOwnershipPrivilege 3032 powershell.exe Token: SeLoadDriverPrivilege 3032 powershell.exe Token: SeSystemProfilePrivilege 3032 powershell.exe Token: SeSystemtimePrivilege 3032 powershell.exe Token: SeProfSingleProcessPrivilege 3032 powershell.exe Token: SeIncBasePriorityPrivilege 3032 powershell.exe Token: SeCreatePagefilePrivilege 3032 powershell.exe Token: SeBackupPrivilege 3032 powershell.exe Token: SeRestorePrivilege 3032 powershell.exe Token: SeShutdownPrivilege 3032 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeSystemEnvironmentPrivilege 3032 powershell.exe Token: SeRemoteShutdownPrivilege 3032 powershell.exe Token: SeUndockPrivilege 3032 powershell.exe Token: SeManageVolumePrivilege 3032 powershell.exe Token: 33 3032 powershell.exe Token: 34 3032 powershell.exe Token: 35 3032 powershell.exe Token: 36 3032 powershell.exe Token: SeDebugPrivilege 880 RegAsm.exe Token: SeDebugPrivilege 5464 powershell.exe Token: SeDebugPrivilege 4376 4767d2e713f2021e8fe856e3ea638b58.exe Token: SeImpersonatePrivilege 4376 4767d2e713f2021e8fe856e3ea638b58.exe Token: SeDebugPrivilege 3456 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeIncreaseQuotaPrivilege 3032 powershell.exe Token: SeSecurityPrivilege 3032 powershell.exe Token: SeTakeOwnershipPrivilege 3032 powershell.exe Token: SeLoadDriverPrivilege 3032 powershell.exe Token: SeSystemProfilePrivilege 3032 powershell.exe Token: SeSystemtimePrivilege 3032 powershell.exe Token: SeProfSingleProcessPrivilege 3032 powershell.exe Token: SeIncBasePriorityPrivilege 3032 powershell.exe Token: SeCreatePagefilePrivilege 3032 powershell.exe Token: SeBackupPrivilege 3032 powershell.exe Token: SeRestorePrivilege 3032 powershell.exe Token: SeShutdownPrivilege 3032 powershell.exe Token: SeDebugPrivilege 3032 powershell.exe Token: SeSystemEnvironmentPrivilege 3032 powershell.exe Token: SeRemoteShutdownPrivilege 3032 powershell.exe Token: SeUndockPrivilege 3032 powershell.exe Token: SeManageVolumePrivilege 3032 powershell.exe Token: 33 3032 powershell.exe Token: 34 3032 powershell.exe Token: 35 3032 powershell.exe Token: 36 3032 powershell.exe Token: SeDebugPrivilege 6076 powershell.exe Token: SeShutdownPrivilege 204 powercfg.exe Token: SeCreatePagefilePrivilege 204 powercfg.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
u10c.1.exepid process 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
u10c.1.exepid process 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe 4432 u10c.1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MSBuild.exepid process 3284 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrosha.exeswiiiii.exealexxxxxxxx.exeRegAsm.exegold.exeNewB.exeswiiii.exedescription pid process target process PID 3396 wrote to memory of 360 3396 chrosha.exe swiiiii.exe PID 3396 wrote to memory of 360 3396 chrosha.exe swiiiii.exe PID 3396 wrote to memory of 360 3396 chrosha.exe swiiiii.exe PID 360 wrote to memory of 4312 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 4312 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 4312 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 360 wrote to memory of 2184 360 swiiiii.exe RegAsm.exe PID 3396 wrote to memory of 1188 3396 chrosha.exe alexxxxxxxx.exe PID 3396 wrote to memory of 1188 3396 chrosha.exe alexxxxxxxx.exe PID 3396 wrote to memory of 1188 3396 chrosha.exe alexxxxxxxx.exe PID 1188 wrote to memory of 3400 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 3400 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 3400 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 1188 wrote to memory of 880 1188 alexxxxxxxx.exe RegAsm.exe PID 880 wrote to memory of 5072 880 RegAsm.exe Traffic.exe PID 880 wrote to memory of 5072 880 RegAsm.exe Traffic.exe PID 880 wrote to memory of 4120 880 RegAsm.exe propro.exe PID 880 wrote to memory of 4120 880 RegAsm.exe propro.exe PID 880 wrote to memory of 4120 880 RegAsm.exe propro.exe PID 3396 wrote to memory of 932 3396 chrosha.exe gold.exe PID 3396 wrote to memory of 932 3396 chrosha.exe gold.exe PID 3396 wrote to memory of 932 3396 chrosha.exe gold.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 932 wrote to memory of 1136 932 gold.exe RegAsm.exe PID 3396 wrote to memory of 5108 3396 chrosha.exe NewB.exe PID 3396 wrote to memory of 5108 3396 chrosha.exe NewB.exe PID 3396 wrote to memory of 5108 3396 chrosha.exe NewB.exe PID 5108 wrote to memory of 232 5108 NewB.exe schtasks.exe PID 5108 wrote to memory of 232 5108 NewB.exe schtasks.exe PID 5108 wrote to memory of 232 5108 NewB.exe schtasks.exe PID 3396 wrote to memory of 3672 3396 chrosha.exe jok.exe PID 3396 wrote to memory of 3672 3396 chrosha.exe jok.exe PID 3396 wrote to memory of 3672 3396 chrosha.exe jok.exe PID 5108 wrote to memory of 1308 5108 NewB.exe ISetup8.exe PID 5108 wrote to memory of 1308 5108 NewB.exe ISetup8.exe PID 5108 wrote to memory of 1308 5108 NewB.exe ISetup8.exe PID 3396 wrote to memory of 3728 3396 chrosha.exe swiiii.exe PID 3396 wrote to memory of 3728 3396 chrosha.exe swiiii.exe PID 3396 wrote to memory of 3728 3396 chrosha.exe swiiii.exe PID 3728 wrote to memory of 2524 3728 swiiii.exe RegAsm.exe PID 3728 wrote to memory of 2524 3728 swiiii.exe RegAsm.exe PID 3728 wrote to memory of 2524 3728 swiiii.exe RegAsm.exe PID 3728 wrote to memory of 2524 3728 swiiii.exe RegAsm.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
Uni400uni.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Uni400uni.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe"C:\Users\Admin\AppData\Local\Temp\ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 360 -s 8083⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u10c.0.exe"C:\Users\Admin\AppData\Local\Temp\u10c.0.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exeC:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\u10c.1.exe"C:\Users\Admin\AppData\Local\Temp\u10c.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 4964⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe" -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"3⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\604470191232_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
4Windows Service
4Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
3Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
1.7MB
MD585a15f080b09acace350ab30460c8996
SHA13fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA2563a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
SHA512ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
488KB
MD582053649cadec1a338509e46ba776fbd
SHA16d8e479a6dc76d54109bb2e602b8087d55537510
SHA25630468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
SHA512e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
3.3MB
MD5b9882fe8bb7ab2a4d094f9ff5442df1c
SHA1e17c146530a4371e0595c195c24863935a3dee8b
SHA2564f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628
SHA512bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4
-
C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exeFilesize
414KB
MD554a03236a463e61572b8098d37944f15
SHA16279b885b11630156b8554f5aac5b5720b5b6238
SHA256562bbfb4dcfdc559641f3a83f0de7323d60220e94bb46e85de889475fb643333
SHA512bfc15816cb1ddc33c6525d0d94305871d4a1d51b225c49273289745ba7269881131c1df587703f0a96d79199a1424ce2fc90f36a57267fe3ca0fa07cfe540695
-
C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exeFilesize
283KB
MD5ace2b92a3208dec19577cbac84d543b2
SHA1c40b8908ebbfa819c3581ec85bfca66bca77b605
SHA2561d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e
SHA512e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f
-
C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exeFilesize
4.2MB
MD51c480386f3a4a56142b7a140590865de
SHA1a2ac30674033c69e96fff4abe4a9693d1713ed75
SHA2560f5ff3c62f03a74c17111cfd684520f46e09371ee861edcba67370fc92800d43
SHA512609fff5db8a0b565dc52a1828677848a4b7691ed51b9312f35171d36cd2342f75976ca4c991c3c3a46fb0402f848f86af12cda7dca1bac98400b6cd4983f34d4
-
C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exeFilesize
2.5MB
MD5ffada57f998ed6a72b6ba2f072d2690a
SHA16857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA256677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
SHA5121de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
-
C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exeFilesize
556KB
MD5e1d8325b086f91769120381b78626e2e
SHA10eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA256b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
SHA512c8c0b424c2ed7ee598997bdc0b0d2099b650a280903716891b0eaa340acf556c0642d921fcb7f654387a4a1f1ec4a32feaf8d872b51ca482a977f11e2974072c
-
C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exeFilesize
5.4MB
MD509567a19fa958357b14baf7841aa959c
SHA1be50017f35f7a24e91dd3f9be7367939b3c6f681
SHA256efc1ed06c96dfe3ed1a4c3944b02282c21a881b8227d1e4297eb56f716cd09b8
SHA5123e02e5ca0435b921ed4199f3314bb3ea1316aa58dc02bd6bb322c14d13157b504a71f6c746f28137de6ed5e504dc178dd2f999e2009b4b5725419cffd88e0019
-
C:\Users\Admin\AppData\Local\Temp\3bdd12b3Filesize
3.8MB
MD513418f74a7ce25cdd6997c9fcb718a0e
SHA1f4c880821fee72c37c882b1e8ebf100efcafe31c
SHA256a890935a36903669f35522c85c75e296404a4595453f060398cb64c5b0d6dfd0
SHA51259017162877bbbdf823450a946e3e54e9130d8ebbf5baba24471c68a10d1fad3452be08c693cd7a78d0bf2fcfd6d3086edeec1a379f9b53fd66bb246c128d4c1
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeFilesize
1.8MB
MD5052a6dbb20766b4a9edd5f68afa368e2
SHA1ede425de400a9d85839bea075e650dd0c71bd20a
SHA256ffbce39b7aa763ad7d134528c138cd0c2c0f8fcb40f2fcf43ad7b13a06af1c7d
SHA512bbd02be4257d183ad4baa1099b44a2fcf032219635e3ae203ed72d9f4d17893bf407e9b15903b22cde69499260a17b8c0729c2ff0a0c74e31177d844ff804fdf
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
7.6MB
MD5862bf3003dca41d88ac49a6846149623
SHA1b34f1d42dd0649d6b83f9a92124a554f48df0434
SHA25650c10789db130a98c63e6e7f6e23b1c89b38c5ea4678f1e06fd1796fba25c75c
SHA512fe5ab7888633dbfecca57ecd1732360796c2f19c62fc4282e2a92e9b8b440cc01e25b7a0c6a608cf9c2e9c9e3c49a8509a08851afcaef7e1afc21c0abcc2c969
-
C:\Users\Admin\AppData\Local\Temp\Tmp20D1.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\cosmetician.mpegFilesize
79KB
MD58e1bbc6d6c4d207393b59853f73945ae
SHA1b66d632eae41267175bf5332d43a785dd929d79f
SHA256b04725aaa99b27e04c02bec7d98fb4511331ea53761272325fff9c27a679e279
SHA5121b45a7be00f54498df289641745ca6ee99e11d63100fb838b96c2d9412f8b5f0ea5aa8b964f32a4f9182cd599765f5ca08b91e8e8eecd06d1c53543284a59001
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exeFilesize
938KB
MD5b15bac961f62448c872e1dc6d3931016
SHA11dcb61babb08fe5db711e379cb67335357a5db82
SHA256bf1a0c67b433f52ebd304553f022baa34bfbca258c932d2b4b8b956b1467bfa5
SHA512932119f7dc6710239481c80ad8baaed5c14a2085fcc514b6522671b1a4ebbaf488e43453f11d5aaf6dcef7a245db8de44d93ff255f7cf8385b7d00f31f2cc370
-
C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\quersprung.vhdFilesize
1.3MB
MD53bee67dd0e04559c8fdc7761336dee47
SHA1027ef9dca01fb928db79e57b418130165f06ed5f
SHA25657745aba2885cf8bf770e7e9195697c05e35333417ca23af153367bf31cbf812
SHA51235fb66f98a57b0d14c3044a91abac3e0670d516edfd691d6670df034e8454c550d3d2e702ab90cd32b70fcba8aeb2e02b7b3a07b6a340a932738968473f77dce
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uuqgzphh.ekr.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD59c341d95c6209b8299fd957311b23d80
SHA1e531011c26e5b9edf736f6a91ff815a22d548429
SHA256a8b67078c02c3fd7006c2775c4a41ccab1c9c3d7fefd0a41bae88c39b3cdcf5d
SHA512f5f939c0e4f22bec91e8a7b45be8ce4720264ad0baab58860568f915d22ffd09a79f5c6d5d7031f4768f5a0fe7bd426d364edbf4f9f79695775e0ef4144b2277
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD537ab95f678e53236f3d3635dd0ee827c
SHA1f8a7ca09598425bbb36632e7e409cfd6adbb6165
SHA2566acfb3eb220aac327a4f6f9517d1e9d22e611867b05051339583da79ea9765bb
SHA512a47b10395b6859c5276fa3162bb7b52c2209432fa22c7c6bf1e349c75f3ee2857f87143189f8bc02a2f3dc75e73c9a69384a75add7790717a4ccd6c55bf3d74b
-
C:\Users\Admin\AppData\Local\Temp\tmp4686.tmpFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\tmp606C.tmpFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\u10c.0.exeFilesize
270KB
MD551627ffc0192dd8143c0c0208392166d
SHA1dba1a938466fd61f41198400e2a899fa43819d7e
SHA2563200fac8ca4eb6abba8e97221ee8e74f68edc6385b02bb5d04adb57e32432b6b
SHA512f92f5d1f598480a34f5bad1a58de59b7c11e9311ee64147c33fedc2889f9184f91e0e02237c2eff6a5efa02543a87d36c99c34ff2b361fca8bd5d8a3baa6025b
-
C:\Users\Admin\AppData\Local\Temp\u10c.1.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-160447019-1232603106-4168707212-1000\76b53b3ec448f7ccdda2063b15d2bfc3_f9d1bf68-a4a3-4e40-8567-86018b80b4b2Filesize
2KB
MD54ed830f7b6810ae9aca0d77d5e6b6036
SHA15248a37bba7f5f524df9499a3801e0308013585d
SHA2566ae809f2fdfdae57360c9054b334ecb165c20a76ee455fdce9acb30bb7ffbef9
SHA5128fe0a527d05c0267779fcdae371d3d85df0fc8545aa021ab468b69ff2691d6d8aebc0bb8890e7907784736f89a7cd8706d4e6d2acfe86648a058d65f074638e9
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exeFilesize
541KB
MD51fc4b9014855e9238a361046cfbf6d66
SHA1c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA256f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
SHA5122af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exeFilesize
304KB
MD5cc90e3326d7b20a33f8037b9aab238e4
SHA1236d173a6ac462d85de4e866439634db3b9eeba3
SHA256bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
SHA512b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
-
C:\Users\Admin\Pictures\iFX0J6W5pEAOvntukzv0lLfZ.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD5538f77e3e78561c3f5c9054901c4495d
SHA1d25e775238adce7d3a79e9e7cea905eec9064823
SHA2562b7affd071f91ac6035b87368ae19ba5ea4c3b9ba44c9aeda100519a472ff8ff
SHA5123e13e0ec70aeda9280c288abfcdd1226af0d607ff51e33063ba242db7dd1dd5dd9c654c030ca019e65b72c3dbbd20837024af45ca8a19d91695aeba57bc337a3
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\WCLDll.dllFilesize
590KB
MD563206e3b4f1fa4dcfbe1f2cc5d0c4e9d
SHA1fe731b2e9c296d9ecc75ed96c2d29fe46c7cd924
SHA2568f5b8645b5e5ea48acc411b21a1b3cd56d2660ac931989b9f064c8ff82039885
SHA51232bdcce9e8e7f1ebe50e114f65f762391d52f482a112515ccb16b09653b93873528ea1a7473a2512075bf8f729997a65f455bf6599482e997b85e06a2f87f3d6
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\msvcp140.dllFilesize
427KB
MD571a0aa2d05e9174cefd568347bd9c70f
SHA1cb9247a0fa59e47f72df7d1752424b33a903bbb2
SHA256fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47
SHA5126e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a
-
\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\vcruntime140.dllFilesize
81KB
MD516b26bc43943531d7d7e379632ed4e63
SHA1565287de39649e59e653a3612478c2186096d70a
SHA256346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
SHA512b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc
-
memory/212-512-0x00007FFD94220000-0x00007FFD943FB000-memory.dmpFilesize
1.9MB
-
memory/212-498-0x000000006A9C0000-0x000000006AB3B000-memory.dmpFilesize
1.5MB
-
memory/360-42-0x00000000008C0000-0x0000000000912000-memory.dmpFilesize
328KB
-
memory/360-151-0x0000000002DC0000-0x0000000004DC0000-memory.dmpFilesize
32.0MB
-
memory/360-138-0x0000000072DA0000-0x000000007348E000-memory.dmpFilesize
6.9MB
-
memory/360-50-0x0000000002DC0000-0x0000000004DC0000-memory.dmpFilesize
32.0MB
-
memory/360-43-0x0000000072DA0000-0x000000007348E000-memory.dmpFilesize
6.9MB
-
memory/880-75-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/880-82-0x0000000072DA0000-0x000000007348E000-memory.dmpFilesize
6.9MB
-
memory/932-141-0x00000000001C0000-0x000000000023D000-memory.dmpFilesize
500KB
-
memory/1136-349-0x0000000000BA0000-0x0000000000C4E000-memory.dmpFilesize
696KB
-
memory/1136-135-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1188-72-0x0000000005A20000-0x0000000005A30000-memory.dmpFilesize
64KB
-
memory/1188-81-0x00000000033C0000-0x00000000053C0000-memory.dmpFilesize
32.0MB
-
memory/1188-80-0x0000000072DA0000-0x000000007348E000-memory.dmpFilesize
6.9MB
-
memory/1188-70-0x0000000000FE0000-0x000000000119C000-memory.dmpFilesize
1.7MB
-
memory/1188-71-0x0000000072DA0000-0x000000007348E000-memory.dmpFilesize
6.9MB
-
memory/1244-538-0x00007FFD94220000-0x00007FFD943FB000-memory.dmpFilesize
1.9MB
-
memory/1244-635-0x000000006A9C0000-0x000000006AB3B000-memory.dmpFilesize
1.5MB
-
memory/1244-533-0x000000006A9C0000-0x000000006AB3B000-memory.dmpFilesize
1.5MB
-
memory/1308-469-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1308-398-0x0000000000400000-0x0000000002C4A000-memory.dmpFilesize
40.3MB
-
memory/1308-218-0x0000000002E50000-0x0000000002F50000-memory.dmpFilesize
1024KB
-
memory/1308-219-0x0000000002DB0000-0x0000000002E1E000-memory.dmpFilesize
440KB
-
memory/1348-311-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1936-545-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2184-55-0x0000000000C10000-0x0000000000C50000-memory.dmpFilesize
256KB
-
memory/2184-46-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2184-49-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2184-52-0x0000000000C10000-0x0000000000C50000-memory.dmpFilesize
256KB
-
memory/2184-53-0x0000000000C10000-0x0000000000C50000-memory.dmpFilesize
256KB
-
memory/2184-51-0x0000000000C10000-0x0000000000C50000-memory.dmpFilesize
256KB
-
memory/2184-54-0x0000000000C10000-0x0000000000C50000-memory.dmpFilesize
256KB
-
memory/2184-56-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2524-234-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2524-294-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/2524-244-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/2924-8-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/2924-10-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/2924-0-0x0000000000A10000-0x0000000000ECC000-memory.dmpFilesize
4.7MB
-
memory/2924-1-0x0000000077B54000-0x0000000077B55000-memory.dmpFilesize
4KB
-
memory/2924-15-0x0000000000A10000-0x0000000000ECC000-memory.dmpFilesize
4.7MB
-
memory/2924-2-0x0000000000A10000-0x0000000000ECC000-memory.dmpFilesize
4.7MB
-
memory/2924-4-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/2924-11-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/2924-5-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/2924-3-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/2924-6-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/2924-7-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/3396-634-0x0000000000B40000-0x0000000000FFC000-memory.dmpFilesize
4.7MB
-
memory/3396-20-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/3396-110-0x0000000000B40000-0x0000000000FFC000-memory.dmpFilesize
4.7MB
-
memory/3396-90-0x0000000000B40000-0x0000000000FFC000-memory.dmpFilesize
4.7MB
-
memory/3396-18-0x0000000000B40000-0x0000000000FFC000-memory.dmpFilesize
4.7MB
-
memory/3396-217-0x0000000000B40000-0x0000000000FFC000-memory.dmpFilesize
4.7MB
-
memory/3396-19-0x0000000000B40000-0x0000000000FFC000-memory.dmpFilesize
4.7MB
-
memory/3396-28-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/3396-21-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/3396-420-0x0000000000B40000-0x0000000000FFC000-memory.dmpFilesize
4.7MB
-
memory/3396-23-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/3396-24-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/3396-22-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/3396-25-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/3396-26-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/3396-27-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3672-179-0x0000000000B50000-0x0000000000BA2000-memory.dmpFilesize
328KB
-
memory/3672-201-0x0000000005650000-0x0000000005660000-memory.dmpFilesize
64KB
-
memory/3672-169-0x0000000072DA0000-0x000000007348E000-memory.dmpFilesize
6.9MB
-
memory/3728-221-0x00000000005A0000-0x00000000005CE000-memory.dmpFilesize
184KB
-
memory/3880-564-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/3880-561-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/3880-559-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/3880-554-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/3880-557-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/3880-552-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/3880-551-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/3880-550-0x00007FF7DE3F0000-0x00007FF7DEAEC000-memory.dmpFilesize
7.0MB
-
memory/4120-107-0x0000000002E70000-0x0000000002E80000-memory.dmpFilesize
64KB
-
memory/4120-140-0x0000000006AE0000-0x0000000006B2B000-memory.dmpFilesize
300KB
-
memory/4120-92-0x0000000000A30000-0x0000000000A82000-memory.dmpFilesize
328KB
-
memory/4120-102-0x0000000005800000-0x0000000005CFE000-memory.dmpFilesize
5.0MB
-
memory/4120-139-0x0000000006960000-0x000000000699E000-memory.dmpFilesize
248KB
-
memory/4120-128-0x0000000005E80000-0x0000000005EF6000-memory.dmpFilesize
472KB
-
memory/4120-108-0x0000000005460000-0x000000000546A000-memory.dmpFilesize
40KB
-
memory/4120-91-0x0000000072DA0000-0x000000007348E000-memory.dmpFilesize
6.9MB
-
memory/4120-131-0x00000000065F0000-0x000000000660E000-memory.dmpFilesize
120KB
-
memory/4120-103-0x0000000005300000-0x0000000005392000-memory.dmpFilesize
584KB
-
memory/4120-134-0x0000000006E60000-0x0000000007466000-memory.dmpFilesize
6.0MB
-
memory/4120-136-0x00000000069D0000-0x0000000006ADA000-memory.dmpFilesize
1.0MB
-
memory/4120-137-0x0000000006900000-0x0000000006912000-memory.dmpFilesize
72KB
-
memory/4376-549-0x0000000000400000-0x0000000003009000-memory.dmpFilesize
44.0MB
-
memory/4732-605-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/4732-487-0x0000000000400000-0x0000000002C26000-memory.dmpFilesize
40.1MB
-
memory/4836-450-0x000000006A9C0000-0x000000006AB3B000-memory.dmpFilesize
1.5MB
-
memory/4836-407-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/4836-452-0x00007FFD94220000-0x00007FFD943FB000-memory.dmpFilesize
1.9MB
-
memory/4836-606-0x000000006A9C0000-0x000000006AB3B000-memory.dmpFilesize
1.5MB
-
memory/4836-607-0x0000000000400000-0x0000000000BEB000-memory.dmpFilesize
7.9MB
-
memory/4836-454-0x000000006A9C0000-0x000000006AB3B000-memory.dmpFilesize
1.5MB
-
memory/5072-129-0x00007FFD77FE0000-0x00007FFD789CC000-memory.dmpFilesize
9.9MB
-
memory/5072-130-0x000000001B110000-0x000000001B120000-memory.dmpFilesize
64KB
-
memory/5072-114-0x00000000002E0000-0x000000000036C000-memory.dmpFilesize
560KB