Malware Analysis Report

2024-09-11 12:58

Sample ID 240612-p7gsyswald
Target aspweb88.exe
SHA256 bc5cc5828933c52cfae2c801627e7d212104193e65c0cb1724dd7a44f11703f4
Tags
sality backdoor bootkit evasion persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bc5cc5828933c52cfae2c801627e7d212104193e65c0cb1724dd7a44f11703f4

Threat Level: Known bad

The file aspweb88.exe was found to be: Known bad.

Malicious Activity Summary

sality backdoor bootkit evasion persistence trojan upx

Windows security bypass

UAC bypass

Modifies firewall policy service

Sality

Windows security modification

UPX packed file

Enumerates connected drives

Checks whether UAC is enabled

Writes to the Master Boot Record (MBR)

Drops autorun.inf file

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

System policy modification

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Enumerates system info in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Replication Through Removable Media
T1091
Execution
TA0002
Persistence
TA0003
Create or Modify System Process
T1543
Windows Service
T1543.003
Pre-OS Boot
T1542
Bootkit
T1542.003
Privilege Escalation
TA0004
Create or Modify System Process
T1543
Windows Service
T1543.003
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Modify Registry
T1112
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Pre-OS Boot
T1542
Bootkit
T1542.003
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Peripheral Device Discovery
T1120
Lateral Movement
TA0008
Replication Through Removable Media
T1091
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-12 12:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 12:58

Reported

2024-06-12 13:00

Platform

win7-20240220-en

Max time kernel

139s

Max time network

133s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 809d8041c8bcda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651fa33474a93a4bb75d072a06c68f2b0000000002000000000010660000000100002000000028d461b2aad6202396b79b72fc0484b573d29d5847827cd489506edd01c5ef69000000000e80000000020000200000003bdfb4514960bcd7e08c9dacff422a9367ab263c7c1ca06378095769882703769000000078c4e68245e6959dd50bcfbc877ef04711d08a49f53d07e01baf86929c2b9071f0afc7dc056aeb99a6231e4a02ac3f3d38a48885a31367adf0ec3b6caa3a7d2464c10f6495f92cd67e6ad28b1edf5b0d21352ccdbdb791d316c18a42a376e4de317ec837d05ec96d73158e4e6cb34343d1aa835cf26a15a141210c82b8f5a9cfa7eca5220ddba9dda12b0a78818663a940000000119bb973c6372b8a8b9810060603bc250881184aa2ee1d31e612413a61135fffb237ea64e222454eb4d99ad54b7c9fed333b81aae06e027c308c2fa8b943e379 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C568E71-28BB-11EF-8F92-565622222C98} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000651fa33474a93a4bb75d072a06c68f2b00000000020000000000106600000001000020000000891e3a54015722ee63728fc84ac096c9f3edde09329443759908fcb20919ebce000000000e8000000002000020000000e1d6a4a8818d6c86dac6f346f8e66a64474d62f7339148606742053c7502ed5c20000000cac4d3284013cca4b8bb3a8ef3093bebebcbddf16070f031f38b33ebf6f7e44540000000789c6d9e123657573b0e43cc3f6a481706cab5ce3e2539ee4cba41587718b9fcede777ff8e41539f45243e889bcfaf2ded2883b07ab530dfb9f465b3e3ac4ebb C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424358959" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2868 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\Dwm.exe
PID 2868 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\Explorer.EXE
PID 2868 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\taskhost.exe
PID 2868 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\DllHost.exe
PID 2868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2868 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2564 wrote to memory of 360 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2564 wrote to memory of 360 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2564 wrote to memory of 360 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2564 wrote to memory of 360 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\aspweb88.exe

"C:\Users\Admin\AppData\Local\Temp\aspweb88.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://127.0.0.1:88/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
N/A 127.0.0.1:88 tcp
N/A 127.0.0.1:88 tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

memory/2868-0-0x0000000000400000-0x00000000005AA000-memory.dmp

memory/2868-3-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-8-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-4-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-10-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-6-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-5-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-9-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-7-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-12-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-28-0x0000000000340000-0x0000000000342000-memory.dmp

memory/2868-11-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-31-0x0000000000340000-0x0000000000342000-memory.dmp

memory/2868-33-0x0000000074EE0000-0x0000000074EE9000-memory.dmp

memory/2868-32-0x0000000074EE1000-0x0000000074EE2000-memory.dmp

memory/2868-27-0x0000000000350000-0x0000000000351000-memory.dmp

memory/2868-25-0x0000000000350000-0x0000000000351000-memory.dmp

memory/2868-24-0x0000000000340000-0x0000000000342000-memory.dmp

memory/1040-14-0x00000000001B0000-0x00000000001B2000-memory.dmp

memory/2868-13-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-34-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-37-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-36-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-39-0x0000000001F50000-0x0000000002FDE000-memory.dmp

memory/2868-56-0x0000000000400000-0x00000000005AA000-memory.dmp

memory/2868-54-0x0000000074EE0000-0x0000000074EE9000-memory.dmp

memory/2868-48-0x0000000000340000-0x0000000000342000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab454C.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Cab460A.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar461F.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d719f8700d9a1374b33f808ba939bb2b
SHA1 1e75a82ca976db466a68e94431189c79062017c1
SHA256 e873a6dd5aa03290985e044681d84257e6842be1dc641c2f91bfb20161f6afd9
SHA512 44baa84b319edb23199a01baac63b206e8d147b448d6ed4f3491cbc74f95a601703b6673182193125ebcadd38035074bc9295a58776d523322b1bbd2ea47e677

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef40baeb6d646cecdf3f3befe719b0d0
SHA1 bede280ff404832ce9f61b92689d072fb937895a
SHA256 a05ba4e935e7cd7a5d9a47c1037b1c072cdf55c0c28bc0d0aa6504c067291b88
SHA512 7b85c9d0852eaaaa8f20e2debf93191be563146138c2c3d118bf0fb5f25dab615e970dbcc3e660b9195bb58119df47204e263cd98347023c191fc10d5f4c0639

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8bb1076c32e3ef27b5eb803c13b58a0a
SHA1 e8b70f4d6cda9789e611c9aa29b4096a323fb859
SHA256 4b5df97700510d28612789f07dfe076eeef01056202831e39f907fe2ae55f598
SHA512 ebfb29d37e166ed634d03e8963c32c42f1d0ff3957b1812b898b1f77a3c6929a9bdc7b7f56375790c43176358eae9ddaa886c1a8e3fbd4f230733ff273eb00eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 244db81f5b4ab98eb3b2334b77ba035f
SHA1 e432eb69fc3461bb5d0e60988962f19921cd3a01
SHA256 c46e9924c4fb1ec4c08b37d518cb2c7ad81662a1b85ccf96762a70ea014e5697
SHA512 1d0d966f1d2922743b57c7777680b528ee9c7b12363aeaa0dd701d090dcdcacfd9e9ee90f0c80c93a9a6494a336fd7596d501a4dec470e74c7de6079e44cc082

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a536255610a8b9488c4bec767964400e
SHA1 cb0ab67929409c2ad0f45d511d43ca5b7b4abe67
SHA256 785ee1e9815d2a5b1982a877d400f5ec696e7c2bc89f73753d3654a55e598383
SHA512 5cbf07d4d8e04e4a126d7bdfa789cdd99a492ec3ccadfff7be3bd4c2c56e766ecd20e54139ff08a4a75970ac5fc2a218177a7650f663a50898733dace391fcd3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 251a682080dbf5c52fd862bb95357dc3
SHA1 839ecad740ebe77fe9cf08c70af2675bb70d6bce
SHA256 835345bd615fe9f66c026516a72c5d560353a2d98920d28a4084b2d421b6084a
SHA512 1b21b1c13a3761097d85d25b90f6dd124ae96d6ccacb9d055eb2b58ae3d886da6d409d240140d6bc46216c12de530bba66ec0725eb2bf099dc3d204cbb6a9879

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a6f866b7d2e6600d06721b4475563ca5
SHA1 83ba560a00ffcc6ca317c51cf67e9c71f615f23b
SHA256 72982f9822ebbc6767aca7c2ab4fffa72512876f2285c37cc17533f10c655fc0
SHA512 cae20b50b85d857aac50d337716a03b12db586c7214604d386963e44a0ec0704084c2dc87bc2042a60791a6a8b98b15481778acccd6cac09fdc3c252608a4d27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b4ed58487a5cef6e26c832c8f7f8b42
SHA1 bb2118508a1ccaa30e7891ad3bc32f2453a70903
SHA256 ca62fcf4c50aac7cdb141781afcb628ada6e9c1e49f7585003e6172a02a072c4
SHA512 086f121c5219581900b31b8c52b6fbba3330c7a41b432a15e7c9d236453536e92aa2e1efb4a364c1b605884868161ff10be7c4966dc029fae578193f3804d9e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2ae139e2df7f244b844c45c7ff0f6394
SHA1 792d20912ade3d25fbdb8c92c00eb4c6d657cdb2
SHA256 b83552c24db9bd0fb28ba82a100c35406d0a1b82084e67f7dd4d4ad90950b115
SHA512 a10a81757be824a44211d7061579f5e119cd5c0b7bdbf777c73a0db916471ab844f7ce2818f646a059dde10c292da0c35706d7360414d08781d4a88cab9f34d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a673cc5b2a6cb584e639b754732cd170
SHA1 52bd14124bd0d7d76e2bc3ee2580490d9ac99e10
SHA256 94c709bc02f3aa0e37d62e19f47d70b583a3cdf8d3bb5c9044f3d078f961ce5c
SHA512 5709c5dae4adef52ff8f577f61ebd8d56e486c71b12a744e559d4a60bdd60e1e0ced40ee5909b77d7f1a3956ccc32efe0de7616be8361c1f531328a94b199559

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1e7b083872fccf16693fce3be9fd3ce3
SHA1 965d23d2a2c1be83aaccd375398dcffa9c7e912e
SHA256 153cc684f1275e54227b86497a529d4ce2ba21baa23505453a46a4ebace97d5a
SHA512 6b1f34d47321dbcd8973ccee17ecc5da3fd584fde9176480f8da4f074dd6b8e6f2447ad881f6ac6ea5e6cc37787f2c8dc813e4fdd036fd1ac6dc9b68a4b4f47d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 66b9409dc37dd791addbda1f3550c907
SHA1 c92e1271204a1d9611619b8eaab3a4a0348e7695
SHA256 7d79f90c7b5aac875dd6573b07566c0901793b65cb1486d436ecbabea0c41c96
SHA512 5916ebd53401d64a55d56a8d41036c71a2eddeeff1f903fcaa0a7e6e4ef4c475e9c0f87d016d0105989ece0787681eb6f7d13b7db1539c28cddf78cdb4a7abcb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 453f8a1f953a1fc55269e396027ef4b3
SHA1 f6a55b25905859819948a1ecf7a492973ad5de6d
SHA256 9bc9f864877c55a95862eb62239f86579ad55be9e627d601b9c479c18dcacab8
SHA512 fee498399054b654b8d97f7ed4c83f1db7c6504efe0c32517eda60c781696407fa953df24cb27a54dc4fda8ce6e01d6c2812b35292a74c70391427b3c9988e19

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 30fcfa9cac0ed55ae52634d6f775d5c1
SHA1 f168af7090acc06f1d018cf6482b8aa01ba52294
SHA256 f4a29463a71f9941331d2a00ba0f450f4de6eb3b6745ab14e845931643619a2d
SHA512 851e981a290c823010c1e6d7d486536cef44906b17b63f2eea76210bc2bf15ae466f2c20d389c29b4b838a5bae34a82ec34c148bf272da7d59e589aa4cce679a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d071d127ecbfef3ee4d89a523666ea2f
SHA1 2434e2cc77cf352feffbb7ed7c2fb1469a0fa87b
SHA256 aef32f4773450f8212a2734d1126f026078deb8a1e8c210ce72b4b4fa556de32
SHA512 be419f32a1b607dac692a64bd956897f8f821767ade911deaab2460a957de7db3fc44b35d9e55e89f79b14728a4db2d585eb9625d4786254b88ad4394f5a8530

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 df9022e3b19f7e5a462408eb50161751
SHA1 d7cd5b91dcc74f1fefaee37d4983a1226d632b78
SHA256 65dad9d16a0893180a3e8b970dacc5735757a69a6eb953513dbc476edfe99eb6
SHA512 b69379741ab546ffe8c392aab8c73ffb6475a2155a979fdde09aedf2a76b66145a5a084c9baf63d52282c06c2bbce438fd302b80f033e459c9a70fea49f9326b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c2ba4ade8fcfcfbad07bb72d02ac886b
SHA1 0517e59548606275c3d835fbf99fc6b859df382c
SHA256 eddb84b7bc246ea4e774e4c9b421b8b9708dec79ab9cea814e9a0d1f0239329d
SHA512 5bd3635258d01dcad396a705e04fd27db0a0f8d59ded1f590bf546496ee52e200897f9557fc0df05600029f5c9440a4610ad0067a51fa427d7e3536919837b72

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8833e30cd7d6b987cd28bd0f0920fa77
SHA1 efcc50c39f8e1d22e1573846abeb464fc9dd48a3
SHA256 4eabd23a8641d3878ed27008b4280caa2de987761af38da48a0734ba67cd0c4d
SHA512 9e42c7389240bd8181146d759399a6753128568cee2a5f90c69774f039f6d98457ecc50d70d3ff276afb5ac8a9ce8c1ef51b266760c4fbd7ffaff5b4c9ecee7e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 12:58

Reported

2024-06-12 13:00

Platform

win10v2004-20240508-en

Max time kernel

122s

Max time network

134s

Command Line

"fontdrvhost.exe"

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Sality

backdoor sality

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\i: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\k: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\n: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\p: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\x: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\e: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\h: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\g: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\q: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\u: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\z: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\b: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\o: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\m: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\r: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\w: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\v: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\t: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\y: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\j: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\l: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\s: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened (read-only) \??\a: C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Enumerates physical storage devices

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 984 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\fontdrvhost.exe
PID 984 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\fontdrvhost.exe
PID 984 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\dwm.exe
PID 984 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\sihost.exe
PID 984 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\svchost.exe
PID 984 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\taskhostw.exe
PID 984 wrote to memory of 3412 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\Explorer.EXE
PID 984 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\svchost.exe
PID 984 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\DllHost.exe
PID 984 wrote to memory of 3888 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 984 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\System32\RuntimeBroker.exe
PID 984 wrote to memory of 4044 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 984 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\System32\RuntimeBroker.exe
PID 984 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\System32\RuntimeBroker.exe
PID 984 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 984 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Windows\system32\backgroundTaskHost.exe
PID 984 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 984 wrote to memory of 2180 N/A C:\Users\Admin\AppData\Local\Temp\aspweb88.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 2348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 2348 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 3320 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 4420 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 4420 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 4472 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2180 wrote to memory of 4472 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\aspweb88.exe N/A

Processes

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\aspweb88.exe

"C:\Users\Admin\AppData\Local\Temp\aspweb88.exe"

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:88/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe83d946f8,0x7ffe83d94708,0x7ffe83d94718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\system32\BackgroundTaskHost.exe

"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5006111980779806521,1401135645876558119,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2888 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.netbox.cn udp
N/A 127.0.0.1:88 tcp
N/A 127.0.0.1:88 tcp
N/A 224.0.0.251:5353 udp

Files

memory/984-0-0x0000000000400000-0x00000000005AA000-memory.dmp

memory/984-1-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-4-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-3-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-9-0x0000000000650000-0x0000000000651000-memory.dmp

memory/984-6-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-7-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-10-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-12-0x0000000000610000-0x0000000000612000-memory.dmp

memory/984-8-0x0000000000610000-0x0000000000612000-memory.dmp

memory/984-13-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-14-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-11-0x0000000000610000-0x0000000000612000-memory.dmp

memory/984-5-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-15-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-16-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-20-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-22-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-21-0x0000000002370000-0x00000000033FE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

\??\pipe\LOCAL\crashpad_2180_HNMTOAFDPMLQAGVH

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

memory/984-39-0x0000000002370000-0x00000000033FE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dd0fc5bf7b7a9dc085b5486a227c2ffc
SHA1 5132b8b7e43ac8e36a33f7ec1b8ea5a4f608dd96
SHA256 afd5c2cedcc6c33d6fd07bc1d58925ea1a45a9a67dbd3e33ae7cf693a0d51274
SHA512 96565bc68a136bc0572ea293f1896f972dbd356121b7855e993f46845d79b1df74eedd7adac999f3ee4c95f01d9216970152aee5389ee0eb86ccff071099b597

memory/984-49-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-50-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-52-0x0000000000400000-0x00000000005AA000-memory.dmp

memory/984-53-0x0000000002370000-0x00000000033FE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

memory/984-64-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-66-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-68-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-75-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-76-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-77-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-78-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-79-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-80-0x0000000002370000-0x00000000033FE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a97fbd905f4395d658c311af91e764cf
SHA1 b67da1f4647105fd9df0d86ca2bbd4c952a461c9
SHA256 dab62225ac820a5ff43101896552686951a882d71c0a33a4da905a2b05e05916
SHA512 b7de6e3e3a167ad48f87f4d3409b5113d51f2d0e9dff7e99c1a8fb4f99535f23a9a51f52121a857d75d74eda0aac80f6d6d6b37818a8e5f72f94e1f17f00b73e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2db84ab7e172906f116e9af1dec03ab5
SHA1 d98ec91b4e4c2074051fb65e6f589cae8b49c079
SHA256 882a0183341ed1617ccd0d4b3fd3821fdeb9bdb2517c2b56e514d4f981749972
SHA512 7a0c93f80e2cad1536f0d77a844ae6a98b9ab7ae2beb715ff5cd79f07ffefab5bf466b20c0352f3f15ea5e7eb6d4d185415ee733d7ae4bd80ee6a135ca2a44ec

memory/984-97-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-98-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-106-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-107-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-108-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-111-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-112-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-115-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-117-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-118-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-119-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-121-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-122-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-124-0x0000000002370000-0x00000000033FE000-memory.dmp

memory/984-125-0x0000000002370000-0x00000000033FE000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 33822bdbe542277b1cc0e63e48cc8a5a
SHA1 9959dad1b71c4602a7c5ae62c394a07063b0f2a5
SHA256 6361e43049888e9c83dc757471c58a065ca42bbef3366593eebb2e4437187f0b
SHA512 1ba78d589e48f8d6278087c853000f9261eb5a966c4916732ada029434105e2119fbcd1bac70406efaec653fbd1cbfda00fd1bde2611c8c69b22c45bdc15b11e

memory/984-144-0x0000000000610000-0x0000000000612000-memory.dmp

F:\xcte.exe

MD5 11d2b2817aa7e0bba812ae4447eca0de
SHA1 24961bc10c90c37db488e9513f8324f43063d954
SHA256 f9e18769130797d5a5e18ba3147126f9161b487abcd32c1c4829620b574f21ce
SHA512 bf5e7ab47ac3b9b04b337deb7a8302b89583ef99ea6546b6d8b1728a6ce797cdaac173350f392f1985da2d3a5d67ae20e3a4053ce9ac6d38a20c968bc99ac59c