Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

NSIS installer

installer

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240221-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1504 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1504 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1504 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1504 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1504 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1504 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1504 wrote to memory of 3020	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3020 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3020 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3020 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 3020 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 224

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240508-en

Max time kernel

121s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1544 wrote to memory of 1696	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1544 wrote to memory of 1696	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1544 wrote to memory of 1696	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1544 wrote to memory of 1696	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1544 wrote to memory of 1696	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1544 wrote to memory of 1696	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1544 wrote to memory of 1696	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

136s

Max time network

110s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icudt30.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icudt30.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	g.bing.com	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	73.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	107.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	8.8.8.8:53	26.35.223.20.in-addr.arpa	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

158s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuin30.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3172 wrote to memory of 3588	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3172 wrote to memory of 3588	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 3172 wrote to memory of 3588	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuin30.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuin30.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3588 -ip 3588

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 616

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	99.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp
US	8.8.8.8:53	131.72.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240611-en

Max time kernel

119s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1152 wrote to memory of 2112	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 2112	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 2112	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 2112	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 2112	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 2112	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1152 wrote to memory of 2112	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2112 wrote to memory of 1944	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2112 wrote to memory of 1944	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2112 wrote to memory of 1944	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2112 wrote to memory of 1944	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2112 -s 228

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240508-en

Max time kernel

41s

Max time network

52s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2448 wrote to memory of 1392	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 1392	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2448 wrote to memory of 1392	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\fbclient.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240611-en

Max time kernel

117s

Max time network

122s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2900 wrote to memory of 2896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2900 wrote to memory of 2896	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2896 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2896 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2896 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2896 wrote to memory of 2908	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 224

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240611-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

Checks for any installed AV software in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira\AntiVir Desktop	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	N/A
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	N/A

Enumerates physical storage devices

Checks processor information in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	N/A
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	N/A
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CCleaner.exe

"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"

Network

N/A

Files

memory/352-0-0x0000000000230000-0x0000000000231000-memory.dmp

memory/352-1-0x0000000000230000-0x0000000000231000-memory.dmp

Analysis: behavioral18

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\cladgenius.chm

Signatures

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\hh.exe	N/A
N/A	N/A	C:\Windows\hh.exe	N/A

Processes

C:\Windows\hh.exe

"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\cladgenius.chm

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	92.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	98.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	26.173.189.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240508-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuin30.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 760 wrote to memory of 2204	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 760 wrote to memory of 2204	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 760 wrote to memory of 2204	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 760 wrote to memory of 2204	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 760 wrote to memory of 2204	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 760 wrote to memory of 2204	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 760 wrote to memory of 2204	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2204 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2204 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2204 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2204 wrote to memory of 2200	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuin30.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuin30.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 224

Network

N/A

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240611-en

Max time kernel

120s

Max time network

126s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2372 wrote to memory of 2852	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2372 wrote to memory of 2852	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2372 wrote to memory of 2852	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2372 wrote to memory of 2852	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2372 wrote to memory of 2852	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2372 wrote to memory of 2852	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2372 wrote to memory of 2852	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2852 wrote to memory of 1644	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2852 wrote to memory of 1644	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2852 wrote to memory of 1644	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2852 wrote to memory of 1644	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 248

Network

N/A

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240508-en

Max time kernel

91s

Max time network

133s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 892 wrote to memory of 2120	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 892 wrote to memory of 2120	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 892 wrote to memory of 2120	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2120 -ip 2120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 624

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	72.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	52.111.227.11:443		tcp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

151s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2316 wrote to memory of 2116	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2316 wrote to memory of 2116	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2316 wrote to memory of 2116	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2116 -ip 2116

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 612

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	172.214.232.199.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	18.31.95.13.in-addr.arpa	udp
US	8.8.8.8:53	92.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240611-en

Max time kernel

143s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cafw.exe"

Signatures

Executes dropped EXE

Description	Indicator	Process	Target
N/A	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A
N/A	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	N/A
N/A	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A
N/A	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A
N/A	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A
N/A	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	N/A
Token: 33	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	N/A
Token: SeDebugPrivilege	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1856 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe
PID 1856 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe
PID 1856 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe
PID 1856 wrote to memory of 2928	N/A	C:\Users\Admin\AppData\Local\Temp\cafw.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe
PID 2928 wrote to memory of 2088	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe
PID 2928 wrote to memory of 2088	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe
PID 2928 wrote to memory of 2088	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe
PID 2928 wrote to memory of 2088	N/A	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe	\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cafw.exe

"C:\Users\Admin\AppData\Local\Temp\cafw.exe"

\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 228

\DEVICE\HARDDISKVOLUME2\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2928 -s 284

Network

N/A

Files

memory/1856-0-0x0000000000500000-0x0000000000572000-memory.dmp

memory/1856-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

memory/1856-1-0x00000000775F0000-0x00000000775F1000-memory.dmp

memory/1856-5-0x0000000010000000-0x0000000010037000-memory.dmp

memory/1856-3-0x0000000010000000-0x0000000010037000-memory.dmp

memory/1856-7-0x0000000010000000-0x0000000010037000-memory.dmp

memory/1856-8-0x0000000000500000-0x0000000000572000-memory.dmp

\Users\Admin\AppData\Local\Temp\Xenocode\Sandbox\CLADGenius\1.0.0.0\Native\STUBEXE\8.0.1135\@SYSTEM@\WerFault.exe

MD5	ad2f82f55aad9d937c2755eb5f01c80c
SHA1	e730c62b2e04ce6439c97120655e6c890038795b
SHA256	6a437bf021c6e0d392051ced6b3a5391a03220c47a9d3f7e003cde12291f259a
SHA512	22abd2de4e86451db03eea6d2dbce087d38ba82be73f7852d3010d00ac990cbfb02546774a29407c9c2510dc44c8e39577ed2ac701fa97808a9a27138b3a6a46

memory/1856-6-0x0000000010000000-0x0000000010037000-memory.dmp

memory/1856-4-0x0000000010000000-0x0000000010037000-memory.dmp

memory/2928-11-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-21-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-22-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-20-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-19-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-18-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-17-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-24-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-23-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-25-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-16-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-15-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-14-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-13-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2928-12-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2088-43-0x00000000003F0000-0x0000000000462000-memory.dmp

memory/2088-45-0x00000000003F0000-0x0000000000462000-memory.dmp

memory/2928-47-0x0000000001000000-0x000000000105B000-memory.dmp

memory/2088-48-0x0000000001000000-0x000000000105B000-memory.dmp

memory/1856-51-0x0000000000500000-0x0000000000572000-memory.dmp

memory/1856-52-0x00000000003B0000-0x00000000003B1000-memory.dmp

Analysis: behavioral17

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240508-en

Max time kernel

121s

Max time network

126s

Command Line

"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\cladgenius.chm

Signatures

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	C:\Windows\hh.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\hh.exe	N/A
N/A	N/A	C:\Windows\hh.exe	N/A

Processes

C:\Windows\hh.exe

"C:\Windows\hh.exe" C:\Users\Admin\AppData\Local\Temp\cladgenius.chm

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240220-en

Max time kernel

141s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\holfix.exe"

Signatures

Drops file in Drivers directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\system32\drivers\tcpip.copy	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\system32\drivers\tcpipreset	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\system32\drivers\tcpip.copy	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\system32\drivers\tcpipreset	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A

Loads dropped DLL

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\de-de\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\fr-fr\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\fr-fr\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\it-it\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\ja-jp\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\it-it\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\it-it\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\it-it\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\de-de\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\en-us\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\es-es\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\es-es\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\fr-fr\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\ja-jp\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\ja-jp\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\en-us\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\en-us\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\es-es\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\es-es\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\fr-fr\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\de-de\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\de-de\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\en-us\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\ja-jp\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000026c3987602597e4d824f65b327ae5252000000000200000000001066000000010000200000001639bf5f6010de5353063881b01f69758c6f4b835ada0a822a3055d540b99d4e000000000e8000000002000020000000975d725afa7d326bf9a9d2a1fab61af5ee4fef06df9ab6e8ecfc9cb78e7da1582000000063bedb9c1af39fbe49fee309889741a3247cc17993a2922b64646f0f8ee0fcc94000000009a4f547bd9ba188890d83881933b7819c2e62fc09eb4aa575e03c26a761b21befb2456588292640711d9f4b1817573569668d07367c1c2129a1e2fccd8a6fca	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com\ = "32"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com\Total = "32"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com\Total = "0"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426101392"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "96"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com\Total = "78"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com\ = "78"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5795EFB1-3894-11EF-8CD1-FA3492730900} = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com\ = "0"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0019292da1ccda01	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000026c3987602597e4d824f65b327ae525200000000020000000000106600000001000020000000fa45b0ce3159456f69da6481f3bcba1e32088e3fb067fa23da36f1b1424b604d000000000e8000000002000020000000f572af8fc79f3d90ac2372b098973f062b74c44fcdc5f0be590a29cfcee78ccc90000000231d83fe025c878cacac057a1f0d9bfe4e12bf32cae861d94aa9bdd06daccbe5f47680a13f4cc768bf814bea7bd07cb9dfc0298b48e00114a45dbcc3fc137800d37fb2ea55dc93dcad28011f752a3ae15812da39c1ed128741eddcd6623420afc907dbd67aa99bfeed78cd65245df35f29c5b54836d0a49b58deafa747775c3abec0f635c5d5748aeb8ca52c1fbfb0f240000000c91eaaef502e35ba9d87d75f6c491a7edaa820058dbb1c0d151faf84911fdc422df18ade4ae5d538948538cc585731a93f33866254b60e332764455b612d6271	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\half-open.com\NumberOfSubdomains = "1"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	C:\Program Files\Internet Explorer\iexplore.exe	N/A
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A

Suspicious use of SetWindowsHookEx

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files\Internet Explorer\iexplore.exe	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A
N/A	N/A	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2192 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 2192 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 2192 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 2192 wrote to memory of 2528	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Program Files\Internet Explorer\iexplore.exe
PID 2528 wrote to memory of 2740	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2528 wrote to memory of 2740	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2528 wrote to memory of 2740	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2528 wrote to memory of 2740	N/A	C:\Program Files\Internet Explorer\iexplore.exe	C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\holfix.exe

"C:\Users\Admin\AppData\Local\Temp\holfix.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://half-open.com/

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	half-open.com	udp
US	8.8.8.8:53	half-open.com	udp
RU	81.177.139.61:80	half-open.com	tcp
RU	81.177.139.61:80	half-open.com	tcp
GB	172.217.169.2:80	pagead2.googlesyndication.com	tcp
GB	172.217.169.2:80	pagead2.googlesyndication.com	tcp
US	8.8.8.8:53	c.pki.goog	udp
GB	172.217.169.67:80	c.pki.goog	tcp
US	8.8.8.8:53	o.pki.goog	udp
GB	172.217.169.67:80	o.pki.goog	tcp
US	8.8.8.8:53	www.half-open.com	udp
US	8.8.8.8:53	googleads.g.doubleclick.net	udp
GB	216.58.212.194:443	googleads.g.doubleclick.net	tcp
GB	216.58.212.194:443	googleads.g.doubleclick.net	tcp
GB	216.58.212.194:443	googleads.g.doubleclick.net	tcp
GB	216.58.212.194:443	googleads.g.doubleclick.net	tcp
RU	81.177.139.61:80	www.half-open.com	tcp
RU	81.177.139.61:80	www.half-open.com	tcp
GB	216.58.212.194:443	googleads.g.doubleclick.net	tcp
US	8.8.8.8:53	tpc.googlesyndication.com	udp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
GB	172.217.169.67:80	o.pki.goog	tcp
US	8.8.8.8:53	www.google.com	udp
GB	142.250.187.196:443	www.google.com	tcp
GB	142.250.187.196:443	www.google.com	tcp
US	8.8.8.8:53	fe0.google.com	udp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
US	204.79.197.200:443	ieonline.microsoft.com	tcp
US	204.79.197.200:443	ieonline.microsoft.com	tcp
US	8.8.8.8:53	www.microsoft.com	udp
US	204.79.197.200:443	ieonline.microsoft.com	tcp

Files

memory/2192-0-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/2192-1-0x0000000000230000-0x0000000000231000-memory.dmp

\Windows\System32\de-DE\user32new.dll.mui

MD5	f124dbe67c50788db4fb1d6a9be8d050
SHA1	2949b65e3155eb8f5bf16e0857459ebd3cd0909a
SHA256	bc5a077b0b3daafda0ef75bbf92b9dfa81b0ff01dbbd603f947282437fe0b4d0
SHA512	861e8ad6c611aaad1cd9e471083e0d6688e6b666dc344baacbb444ddc1d94c71f480ce773cad07ec1bad7687c13fcdedb4104228f38dfdb79b5b7e8bd74f87e3

memory/2192-27-0x0000000003190000-0x0000000003394000-memory.dmp

memory/2192-9-0x0000000003190000-0x0000000003394000-memory.dmp

\Windows\System32\es-ES\user32new.dll.mui

MD5	532ed4f40d2b6f0b9b2490fc3202f79b
SHA1	3e11449ef3e737df8c969946468c48d232d8dbe6
SHA256	8b38226109ce42f831e3b2859f09ceb6dc871fc35e184f05e5e5425b290e41d6
SHA512	20b51771064755a40082c7558f2903bef5bcd33bd5d9c40c47de10a59673b95f8532eac2047ad2a087a3b6243a2a982a32d552c0e0c455b84c82641c6089ab82

\Windows\System32\fr-FR\user32new.dll.mui

MD5	0d57d091e06bb1e58e72e5d08479fddf
SHA1	8e1885e1c030d9ff96c20150c34fa9bd7ddc4919
SHA256	67eee41ba82aad3adf2b4c34d108cc88b108c9eebc02f901863e2c8438e38b40
SHA512	3c38cc5b0e4525dab39ae08cfb57c08a8b28e6ae7bb0a8adc38fdee7ae5461966b0b3f026ddc6b198ce45ec661a940f887d9885e8c8dbc590823dc7ca47a8246

\Windows\System32\en-US\user32new.dll.mui

MD5	ef9bc0d92f9af6a446ca3179efda0ce0
SHA1	fd411d68b187aa5ef59852c9b815846fcf794bbf
SHA256	4420eca521bf0c29aa2b14835a9c4d36770a2c42a3c8b097a7a755e8937b419b
SHA512	171014b7de0e59cd81291fc970c9205616c16ebd8918812a9d59f7342ccad1ac0a3f4971a1c5d846418d58aeadcd08c2edec1bcfda9b8f22e6ac3c3dba7e2479

\Windows\System32\it-IT\user32new.dll.mui

MD5	8600c49b59928f85c1db3aab8d1571f6
SHA1	2a7ade977bf35fae4e51c0c8c25c3fce99d601b4
SHA256	d58f104cb5ef742c6cf34edc2d5d7d90f2e24c39b43891f2a2c07cded4bb9c34
SHA512	225e9991df48c2c31db4504e18a54696b7644b0f77032917bc2d0b8e198433fb2aaceff07b612dba24a72571ebcc09adaf6de0f270428da5e9862036f0ea4c9f

\Windows\System32\ja-JP\user32new.dll.mui

MD5	a6beeda73b13dfdb10ae4bbab0209986
SHA1	0028487943dece80b9b32952cce430e2145f1efe
SHA256	7d91394a5c63cd5c6a599700ee0c079b9561f2824973695c886c77982a6adea9
SHA512	adcbb2b4b045317a6a0b69e77f263c259bb5aac6f4340f6bc44196720bf30ab238fefe6d9a9fc5918d47471a5d652298af20ec89758d70da5d01534aeebdb11a

memory/2192-128-0x0000000000400000-0x00000000004C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\f[1].txt

MD5	ddc8fc9e5ed5b9ceb3310d1420742da8
SHA1	cc24cc6b88c87245febc08be6f6eab5d0824b8e3
SHA256	8cf22d4d96855b3a926c1d6e14ff39c7817c3c01b64196e9ccd4d3ce1a0ccbdd
SHA512	8fe7add3cb81a1b6fc5eb4e57f14898fec91e64c5267c7047fe5c6451d12485d870fd51de1bac673ec0e5e4fa366c1443b46dfaae0ea636742d7cedf47cb49e4

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\JAEZQD4L\half-open[1].xml

MD5	c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA1	35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256	b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA512	6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\favicon[1].ico

MD5	b52bccba80f24a0302940325d198dc4e
SHA1	59482479a5cd3e85397758902c5ed0517a73b713
SHA256	0733e9ae345ee15b468e2aa7363e87aad4e8a42f2e55e641acd02c0c42031a21
SHA512	3c5c727f40bb803b62f701e28150bf65dd17a06ba4873efd2629fc62bef933a74b6ac152bda260d99039511ddc9987cfd686d572fd8376bd404e22276048f964

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jw2rl61\imagestore.dat

MD5	ccaad2ba980589df32d1f3706b15143e
SHA1	00f135c6af37918c730d6072aceac3b49618fc04
SHA256	06c71ccbbb48db7c73099d122f369c10b15a010aa2b2a7c316464db031b11b17
SHA512	042d1f095f5d0f8686b6b31115f40277757349d00df2f0660fb85c103a43039366bf0b7ce7e300e1dcc1fda09804838851e71eb7d0933f83214a40dee4c43ad7

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\EVVI415O\www.google[1].xml

MD5	50357ef4568744eb35f261713f0a2066
SHA1	6330f7353635bb3e1e15aa78202850ff4d9e4003
SHA256	0c601811f8c732ca3222c4f3ec169901fc0541655e79c69a11751ba44524f725
SHA512	96f593d6fcbee3067438bca17c50ce1e04d3b6ef37a222cc366067cd40e9abf6f7b9d496f8e7eac75276514265b1ad8ef8270bc3baa4950a8001b8e2670493e9

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CY2G78MW\f[2].txt

MD5	38339212ce1f47762b00f774428c9146
SHA1	83d0a78e31bb6fb317d786480fca1b837557d678
SHA256	925d416095684a9ed6276ac3fb2ec4307a65b6a62ba2adde21208eb95ff0830b
SHA512	451b4d0a6a2faeb7f69ceb70fcb1e5c3159f18560f0322fcb519a7fb2cf6ef9129806fbf76435bb91a0229d4c110caffe65105f4da99c42e98aac47dd9f2a0e1

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\f[3].txt

MD5	98408a561a774e2414e19971eec1f993
SHA1	f51216ceb3dc42de1416511664a7ab3bf7ef6b55
SHA256	bc7ef6c5abc6ad9f53e4b766c83bd5f57fce9d43db9cca546b1187e4a0583ef1
SHA512	a81646843f0d44a52db9e04debcd5262d8892827aa0608fa3a9284f3963e9177cbf3ae99538c28692dcfa78ed6240ace96486e9e6eab6562a6b8d9e1b545f844

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\f[2].txt

MD5	ac34906f1e0a4cde17b1ae0620a05a9a
SHA1	b93c3a3f14902376bcf59628bb88b6c396da3894
SHA256	a0a1f658a1e594724109b586bc66c22913d8a2eee1bafa861f82e39699a69463
SHA512	d1323b59f44bc8444407aa67ac87ed996a9fd3c88af34c9dd97e636b2f5ac5e9a70d20556a88045ddf4be3eede21ec4e7a6b5c449bd03ac1780871c66b89f7b4

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\f[3].txt

MD5	cc47d2de85d243938c1e5277f7be2cbd
SHA1	df36c30bc0dc38b9aab1a2e9ca9fd12447ea2a74
SHA256	2897afa8893463a77bfde7d06c22334a7c2b4b671d2bbdaafc06396d6d4a50c0
SHA512	bbb56750c63e11583a48e82357bc0a2e95bd92d612d282981216ebb7b453841f272dea552fa963da632ddc1d111494d417801817574972b49c58d70be444baf3

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\I2qUFQRfrMumZh7jZD1OuWiOpNfXCU8kmvnsrzk0bzI[1].js

MD5	ec76a06a5a44d0ca983871248ea8aa2a
SHA1	921f472e4340d6d489b1891e798badf1c2b534e4
SHA256	236a9415045faccba6661ee3643d4eb9688ea4d7d7094f249af9ecaf39346f32
SHA512	7112b0a38f4587f7f2c9f9393f984c01e2ce04dc055ac2f44a5315c59a8d8e1cfeed9a15073e6b55d831e170c62c4bd4a68c877c718baf8db65f6360c89a655a

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\f[1].txt

MD5	8b4778bb22dcfcd74d1860041722ea01
SHA1	6c2676fbb1b8a70a46ec0d518d3364c906d0149c
SHA256	066bf781659af09bb40a24a7d87dd2310c2324c9619e347c6d6d05c00ffeb182
SHA512	99ef210ba36ec1ee9d5b4787e84d05fd9f2a7f0f8bb677437e95483077d6d66940002f3b0aa211bff34ea4727be82a54e0b88db49012a020823726270a9a6691

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\uWv0tZr1g4yjhscCRqiRBgkX4o_GbFMllRVwvBM3xsE[1].js

MD5	892803d57ffc8be625c8421657af1460
SHA1	6776453c1a3809358767d63e76f415a9443a2b16
SHA256	b96bf4b59af5838ca386c70246a891060917e28fc66c5325951570bc1337c6c1
SHA512	0038911eca670d4cef15ed59f1123ed32baa72c7f9c0cb1f6c0e4e3feffba6b5f0dbd338e85d1858dfc6fb24f63d9ed93e61a0da393fbde8c8f7490bcdfdba5e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	4bd1fffdcc6c20aac32147c6f1f1b338
SHA1	d897d888bae3820606df8714a4d3b57cf9dd3606
SHA256	a73a7d279e2f813cb4e7351fdfd0a6ca2a034c3eb48cf439525d4345ad39bc7c
SHA512	83f3bc5cd25dd09abdf2387d66844a5b3c4891ae6d6893ca80d1a5aa17f3659b95e50927334dfdd8644a9fabdcdde97daae05186e5f819142d63d4fc383473cc

C:\Users\Admin\AppData\Local\Temp\Tar479F.tmp

MD5	9c0c641c06238516f27941aa1166d427
SHA1	64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256	4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512	936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab479E.tmp

MD5	ac05d27423a85adc1622c714f2cb6184
SHA1	b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256	c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512	6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar488F.tmp

MD5	4ea6026cf93ec6338144661bf1202cd1
SHA1	a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256	8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512	6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5	49aebf8cbd62d92ac215b2923fb1b9f5
SHA1	1723be06719828dda65ad804298d0431f6aff976
SHA256	b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512	bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	c4e026bcc9d51600e1a3238f8f11b1d3
SHA1	7744ba82c505dde26ce954f10c9659b2e382d3ab
SHA256	75ba3988780535b47fd1f8db910ab27289d01fb8e18fe54d63d9ff23decb4900
SHA512	f8a2afbcc3535d6eca633c36d2559051f28d4c7c27d67fda81d0e4f177b4e4af40736e70c1cc2c8951b607aee5d444afe252eb5fbc03873bde11932dce1948eb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	4a813ccb5cbacdfb35604ad7ad63baa1
SHA1	003d3af6393fdd895e0cf6f61fc34eba8d3618a1
SHA256	99c7fc32c7c77f892728863e890c4168b83b675677711fb4cc8b786c1e651c27
SHA512	030504f7c2f0eaa326ce06305accef4ed21a3f2364fbfe35bf85ebc82e39ab7772118383c55278160a286aa677212682fbaa19838c4c4fd445ff7f708ae678b5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	92ffd924e98d6d6b75de4916eac10c37
SHA1	d971ec9bb693b3fd87e40e713d4a398b785e80e3
SHA256	b4c21fee6b75643cfd72149c7aa3449ea172e627ce82e9c49a376b3152327bab
SHA512	a18cd7493c393c48493b36cf3726f43a92947841137895b789009b7418424ec190b2d902cee0cb41de6724e827092a71d9bc71f1fac2b126abdb77c7ea31944d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	a3a486fb426eb51d02bac9ab6d0d7989
SHA1	e25c84f1e0469004bbee0f48ad1bfe78458d9e3a
SHA256	5428f776bc0d372d2550c3bc85713f9d2b5306daacff16c263fbb915f25cb924
SHA512	ea3181f6de8464c6fc1b642cc568a3121ae7aa8d69f31343e4a2947deeed3e6afb7ec609299cdd003cad88785351987b86d41c8df271eb07f730dcdf3d63d803

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	fb37997f752d5d312666f34580e4bd42
SHA1	8f4de30841c70c1b94fc55f3f2b62446f0e7a1f4
SHA256	ab8822353baac410a1d206dc50b185a0da9f6529d1c29d5b9f6231cfab639c9d
SHA512	f09cb47bd5bfbf6df102e4847236e7f5e83ea732962695c932b29b1cc2ee288e1a4e1bb0161f62e68d3e361c0ed51cc1173be4b6585045154b70210f9b543232

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	e2c57fe11ffbf2661c1a448cc7d74acc
SHA1	4ec39a86af011be0665b30680f676618b252702d
SHA256	2072df73802b0832b6c9c852092bc719eccf06dce4c9d25d7758ae46bf9394bd
SHA512	f8dc3e5f26594f6e3466b4b950ea68980aec43bfab6f4cc467ff6929c840cd8cc40c4f17bc9160cf03943606cf1442209450d22f69ae224a300441f95b991e0a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	699543724c852ab544ca2899f95e9b65
SHA1	91d12737f49f8b7d9e13be490196ade7052ebd7c
SHA256	b90fefd2edba70e19ecfb5cd397ebcc9e71f68282d34add8c17f08683d3093a7
SHA512	f8ca18078c40ed451bb344d9adccda3f2b405740e23a121382fc0ec13798f9ad5b3a9bf18e90848f1eeee68f0973b8a03d0effa73445333ed10aeee353c81ada

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	d23bc6bc915ee48391f48a8442321267
SHA1	e2ee313f79a839ec734bdf0ab956cd3d76767dd1
SHA256	8b02ab24baaf5dfa9973667b8c40f8853094e0e01f7e54c23b1295fe76e401f1
SHA512	03de94e078587ebf5b5a7b6db685892114fb28f477d923756846afa62f33f08849b5de3dbf6561aeba7306a585a948777c34a6481a3722dd0be397a2741caec3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	104084609648bdcf30973b6cc4fdf5df
SHA1	bd1eec3c6133136c514c6647cab12d5294435d7f
SHA256	eafe72bc3e9ca9ef3adef6b4bc9e384c97affead074ae46c3ffd9797331fa129
SHA512	d92c5043cf2ade40f3717af3e36ed0babc5da7dd966649561196c064fa36c33a3dd78ea66240b6fc0d378ea77c44924f0e31daf97f2698d69a447e8f9adb2e26

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	a2478cf55a9cdd78e086922dae23246c
SHA1	b6b656a574b262726cabffd7ce4c24430e33ba94
SHA256	46095880fa5c821278e3e8aa5eefdf306e0f41ac0a90c688f9e3fbaad502696b
SHA512	4ebe4160dc6a972bbaaf032c699931cfbd38c6f8f2ffc629e0b8eae48c65baed837b004ca1b3ac89f9fb19f837917f8c422e8ec34394d55a64fa771a16ecb1cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	1af985387b0c254d245a81b686a2932e
SHA1	70def1f0c841207b6c0f289431a30a175950d58d
SHA256	0b566f41ea4dbb52c9d58b04c63522f27af383a986649071bdcd15ef68fdc950
SHA512	8425a79c7fefa825fdd2244174f9f87d0ce3e65957c39a5c884481d237c336f08f4500bb0fe4dbc7c1879b910255749bc2c562fefff7b2ef8b816a6ff1c346e8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5	986bfaf88976124ce61939c8aec178b3
SHA1	41eacc4062f10ea8aba3ffe088ddaf392af9fe65
SHA256	e06ea06822a29b91b172a451edd1822fa12c8267a4b1dc0dc49c99d299d24916
SHA512	55c9b7d58f617650d4af8d20084e916607c06787b3ad02ddd710fd1751a13c270bf22dd60b86b5c43857155cad937be69875441b59fe85cae3e4941be2e62ccb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5	a266bb7dcc38a562631361bbf61dd11b
SHA1	3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256	df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512	0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	87c6eb7cae9dcae784f37fdbd56b3bbb
SHA1	7c90651932d42ae450e7eca681aa0d411bc75b51
SHA256	104df3e229ee0543c80979beff1383ec44eeed53e856af49e39170c3c8f0cd3a
SHA512	7eb956856be496c2ad71b28f334a820c47c71d74962fd3c9b321ceaceea7a594009d71d9563cb5564b1f7f6f00c7f1525e7b4af8c9ed7cb41cc55db8bbb0d98e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	7fdbb9d5241922961b64181bcb230764
SHA1	0eb876ccf19275bc95ceec32c7adf8da08536215
SHA256	b989902acc21328c7d441cc366709a8d09953690affbf3a5227170918200d9a1
SHA512	462ba4c6f2fa7ef5db645bbdbbeb1a9a5313fa1e01a90ea5b040a2387235330f0a26a4da26af2fa6cb71cf3273051e6e9a30d20a8baf01ade803298a165ac789

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	9260eca0853496abd37898ca17d0b6b7
SHA1	69dfdc9fc9669e50667d669528adb0592e41d82e
SHA256	1c1630daa183a67e4f3810768898663d7f749c21ba343336262a0b2eec868e55
SHA512	b301eda4394b21a7f5d802716c4f6bb3bf38d87395dccf5382dfe09f308bf0ae11b8e9ea570fcd5afbb5a948b533f39548233249ef60cd681a50950de39b32f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	10822c62605762b06457c956bf580abe
SHA1	1aa8ca9ad1b18a8791bb5fdf754e81e9fe48f208
SHA256	e41b93adf05db580666688e272972dcfc166de3eb7614a85668a82b3ddeac38d
SHA512	643ffa2cdaa2aea6e7c21612f2f5f4912072996f2768980bf0eff55b5443bb589e0df1c3099f359a4b3b0577bc6d20ee844dbb73bed5908b27388e021be49b8a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	ad001ac81cde25ef6b093f27602f9c58
SHA1	b46301da1e9fe361b616cc5b81b86e8861cafd80
SHA256	faa1763d68b16d98c7eba02f0a11a0a589e6f805f6a32deb5271980ad0f61a84
SHA512	d9c2840be4537792d894ca39bbd4fc61ab4d91e119d83a621f2440efe865994a68dad706be13674f312962ee6b9b682ff13d78f105b4cf887cda7ce94bc075e5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5	e4a68ac854ac5242460afd72481b2a44
SHA1	df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256	cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512	5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	2f2d5a9ff812a0e8d83d0ac621d6ffd6
SHA1	d3fc348e33e66148f4e4754e70174bfad11a3f42
SHA256	5058185931e10e30da1f7fbdd80267ed2366f48cba7c7a1c33edabf27fde6e47
SHA512	ddc6025588b5916faa0628d67f25ec2acc35f47381ad0bfe1207b90e66f6db52327214da820f1a557a2763509c8d1ca5cb9872b27a3f16781dcfd7e1d4cc6300

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5	e12b97258d02bfffdc91d6310e6d9b0c
SHA1	d3055734f5a95ebade3f8dd463f019d88ece74ab
SHA256	a07c55846c618c5c162d41900d37d5e8e68d3244396fcc66f0b6a3e2b1a00266
SHA512	231c317947b6fcd0e270321b777e95e6e72144de355533bf99d17c517209e23c5ccbf938662ce71b38889e5158a1cb30d78bab215162f3213ed9b15311988973

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5	b69f7ddd7c43171b05550e739edc8a5e
SHA1	9fdc3fe4538deaaed3003ff0ad0575cb74381e87
SHA256	f244af116f514f448cca94ea10acf19a85b484c62f6d2820fd1420c30c41c098
SHA512	18f0c2510628fd887af6759c3c605fe8b09e8aa4ba16b24e21ae3f7d5966422f789ae9c811b4197634ca333b53e84109add2efb9d49ed318edf20e54c706ad60

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

130s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	0.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	58.99.105.20.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	92.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240611-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icudt30.dll,#1

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3056 wrote to memory of 2208	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 3056 wrote to memory of 2208	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe
PID 3056 wrote to memory of 2208	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\system32\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icudt30.dll,#1

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 3056 -s 80

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240220-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe"

Signatures

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118.exe"

Network

N/A

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240221-en

Max time kernel

121s

Max time network

125s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.mshtml.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.mshtml.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240508-en

Max time kernel

53s

Max time network

66s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.mshtml.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\Microsoft.mshtml.dll,#1

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

133s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\decaptcher.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2748 wrote to memory of 1048	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2748 wrote to memory of 1048	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2748 wrote to memory of 1048	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\decaptcher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\decaptcher.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1048 -ip 1048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 612

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	55.36.223.20.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	26.165.165.52.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	107.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240508-en

Max time kernel

122s

Max time network

127s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1700 wrote to memory of 1740	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1700 wrote to memory of 1740	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1700 wrote to memory of 1740	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1700 wrote to memory of 1740	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1700 wrote to memory of 1740	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1700 wrote to memory of 1740	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1700 wrote to memory of 1740	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 1740 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1740 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1740 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 1740 wrote to memory of 1948	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 224

Network

N/A

Files

N/A

Analysis: behavioral19

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240611-en

Max time kernel

123s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\decaptcher.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2260 wrote to memory of 2216	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2260 wrote to memory of 2216	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2260 wrote to memory of 2216	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2260 wrote to memory of 2216	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2260 wrote to memory of 2216	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2260 wrote to memory of 2216	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2260 wrote to memory of 2216	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 2216 wrote to memory of 2228	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2216 wrote to memory of 2228	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2216 wrote to memory of 2228	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe
PID 2216 wrote to memory of 2228	N/A	C:\Windows\SysWOW64\rundll32.exe	C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\decaptcher.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\decaptcher.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 228

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win7-20240419-en

Max time kernel

117s

Max time network

119s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll

Signatures

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID\ = "LCPI.IBProvider"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ibp\ = "LCPI.IBProvider"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll,1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer\ = "LCPI.IBProvider.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Data Link Page [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\flush_log_period = "0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID\ = "LCPI.IBProvider.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ibp	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLEDB_Services = "4294967295"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version\ = "3.0.0.8628"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\ = "Extended Error Service"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command\ = "notepad.exe %1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Advanced Data Link Page [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 1752 wrote to memory of 2188	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1752 wrote to memory of 2188	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1752 wrote to memory of 2188	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1752 wrote to memory of 2188	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1752 wrote to memory of 2188	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1752 wrote to memory of 2188	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 1752 wrote to memory of 2188	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll

Network

N/A

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

152s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll

Signatures

Modifies registry class

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID\ = "LCPI.IBProvider"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command\ = "notepad.exe %1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Data Link Page [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ibp\ = "LCPI.IBProvider"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ibp	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open\command	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\VersionIndependentProgID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLEDB_Services = "4294967295"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID\ = "{769A1280-04BF-11D8-AE8B-00A0C907DB93}"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll,1"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\Shell\open	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ProgID\ = "LCPI.IBProvider.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CurVer\ = "LCPI.IBProvider.3"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider\CLSID	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1282-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibprovider.dll"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1284-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Advanced Data Link Page [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\ExtendedErrors\ = "Extended Error Service"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\Version\ = "3.0.0.8628"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1281-04BF-11D8-AE8B-00A0C907DB93}\ = "LCPI.IBProvider Error Lookup [v3]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\flush_log_period = "0"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\InprocServer32\ThreadingModel = "Both"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{769A1280-04BF-11D8-AE8B-00A0C907DB93}\OLE DB Provider\ = "LCPI OLE DB Provider for InterBase [v3] [RC4]"	C:\Windows\SysWOW64\regsvr32.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LCPI.IBProvider.3	C:\Windows\SysWOW64\regsvr32.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4136 wrote to memory of 652	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 4136 wrote to memory of 652	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe
PID 4136 wrote to memory of 652	N/A	C:\Windows\system32\regsvr32.exe	C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\ibprovider.dll

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	107.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	88.16.208.104.in-addr.arpa	udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4140 wrote to memory of 4328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4140 wrote to memory of 4328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4140 wrote to memory of 4328	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\icuuc30.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4328 -ip 4328

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 616

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	183.142.211.20.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	237.21.107.13.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	56.126.166.20.in-addr.arpa	udp
US	8.8.8.8:53	107.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	22.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp
US	8.8.8.8:53	84.65.42.20.in-addr.arpa	udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

132s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4624 wrote to memory of 1244	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4624 wrote to memory of 1244	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 4624 wrote to memory of 1244	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1244 -ip 1244

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 636

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	13.107.21.237:443	g.bing.com	tcp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
NL	23.62.61.97:443	www.bing.com	tcp
US	8.8.8.8:53	97.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	58.99.105.20.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	240.221.184.93.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	23.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	150.171.27.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.27.171.150.in-addr.arpa	udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240508-en

Max time kernel

46s

Max time network

60s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Windows\SysWOW64\rundll32.exe

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 836 wrote to memory of 2484	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 836 wrote to memory of 2484	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe
PID 836 wrote to memory of 2484	N/A	C:\Windows\system32\rundll32.exe	C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\LangDLL.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2484 -ip 2484

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 600

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240508-en

Max time kernel

92s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"

Signatures

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2152 wrote to memory of 3332	N/A	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	C:\Windows\system32\pcaui.exe
PID 2152 wrote to memory of 3332	N/A	C:\Users\Admin\AppData\Local\Temp\CCleaner.exe	C:\Windows\system32\pcaui.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CCleaner.exe

"C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"

C:\Windows\system32\pcaui.exe

"C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {22bfeed6-cb41-4fe3-9e7b-fab443ef9e19} -a "CCleaner" -v "Piriform Ltd" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 2021048 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\CCleaner.exe"

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	73.31.126.40.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
US	8.8.8.8:53	50.23.12.20.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	107.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	13.227.111.52.in-addr.arpa	udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

133s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\cafw.exe"

Signatures

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\cafw.exe

Processes

C:\Users\Admin\AppData\Local\Temp\cafw.exe

"C:\Users\Admin\AppData\Local\Temp\cafw.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 5112

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 268

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	8.8.8.8.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	133.211.185.52.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	2.159.190.20.in-addr.arpa	udp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	58.99.105.20.in-addr.arpa	udp
US	8.8.8.8:53	58.55.71.13.in-addr.arpa	udp
US	8.8.8.8:53	149.220.183.52.in-addr.arpa	udp
US	8.8.8.8:53	157.123.68.40.in-addr.arpa	udp
US	8.8.8.8:53	15.164.165.52.in-addr.arpa	udp
US	8.8.8.8:53	101.58.20.217.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	205.47.74.20.in-addr.arpa	udp
US	8.8.8.8:53	21.236.111.52.in-addr.arpa	udp
US	8.8.8.8:53	172.210.232.199.in-addr.arpa	udp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp

Files

memory/5112-2-0x00000000004B0000-0x00000000004B1000-memory.dmp

memory/5112-1-0x0000000077382000-0x0000000077383000-memory.dmp

memory/5112-0-0x0000000000730000-0x00000000007A2000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-07-02 16:58

Reported

2024-07-02 17:01

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\holfix.exe"

Signatures

Drops file in Drivers directory

Description	Indicator	Process	Target
File created	C:\Windows\system32\drivers\tcpip.copy	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\system32\drivers\tcpipreset	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\system32\drivers\tcpip.copy	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\system32\drivers\tcpipreset	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A

Possible privilege escalation attempt

exploit

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

Checks computer location settings

Description	Indicator	Process	Target
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A

Modifies file permissions

discovery

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\takeown.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A
N/A	N/A	C:\Windows\system32\icacls.exe	N/A

UPX packed file

upx

Description	Indicator	Process	Target
N/A	N/A	N/A	N/A
N/A	N/A	N/A	N/A

File and Directory Permissions Modification: Windows File and Directory Permissions Modification

defense_evasion

Drops file in System32 directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\System32\en-us\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\uk-ua\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\de-de\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\uk-ua\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\it-it\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\uk-ua\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\en-us\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\ja-jp\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\ja-jp\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\es-es\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\uk-ua\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\es-es\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\fr-fr\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\fr-fr\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\de-de\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\en-us\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\es-es\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\fr-fr\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\fr-fr\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\it-it\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\ja-jp\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\de-de\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\en-us\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\es-es\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\ja-jp\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File opened for modification	C:\Windows\System32\de-de\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\it-it\user32copy.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A
File created	C:\Windows\System32\it-it\user32new.dll.mui	C:\Users\Admin\AppData\Local\Temp\holfix.exe	N/A

Enumerates physical storage devices

Enumerates system info in registry

Description	Indicator	Process	Target
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\system32\takeown.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A
N/A	N/A	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 3116 wrote to memory of 4736	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4736	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 5108	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 5108	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1056	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1056	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 820	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 820	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4108	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 4108	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1168	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1168	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 824	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 824	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1208	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1208	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1356	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 1356	N/A	C:\Users\Admin\AppData\Local\Temp\holfix.exe	C:\Windows\system32\cmd.exe
PID 4736 wrote to memory of 5036	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4736 wrote to memory of 5036	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 5108 wrote to memory of 3560	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 5108 wrote to memory of 3560	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4736 wrote to memory of 4380	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4736 wrote to memory of 4380	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1168 wrote to memory of 1076	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 1168 wrote to memory of 1076	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 820 wrote to memory of 4764	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 820 wrote to memory of 4764	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4736 wrote to memory of 5088	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4736 wrote to memory of 5088	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1208 wrote to memory of 1424	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 1208 wrote to memory of 1424	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 1356 wrote to memory of 2432	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 1356 wrote to memory of 2432	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 1056 wrote to memory of 4652	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 1056 wrote to memory of 4652	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4108 wrote to memory of 8	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4108 wrote to memory of 8	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 4108 wrote to memory of 3064	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4108 wrote to memory of 3064	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1168 wrote to memory of 456	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1168 wrote to memory of 456	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 5108 wrote to memory of 1516	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 5108 wrote to memory of 1516	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1356 wrote to memory of 4060	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1356 wrote to memory of 4060	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1168 wrote to memory of 1280	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1168 wrote to memory of 1280	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4108 wrote to memory of 3068	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 4108 wrote to memory of 3068	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 820 wrote to memory of 3184	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 820 wrote to memory of 3184	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 824 wrote to memory of 3896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 824 wrote to memory of 3896	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\takeown.exe
PID 820 wrote to memory of 648	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 820 wrote to memory of 648	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1356 wrote to memory of 4572	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1356 wrote to memory of 4572	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 5108 wrote to memory of 2272	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 5108 wrote to memory of 2272	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1208 wrote to memory of 3932	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1208 wrote to memory of 3932	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1056 wrote to memory of 3236	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe
PID 1056 wrote to memory of 3236	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\icacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\holfix.exe

"C:\Users\Admin\AppData\Local\Temp\holfix.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\de-de\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /grant "":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\en-us\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /grant "":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\es-es\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /grant "":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\fr-fr\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /grant "":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\it-it\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /grant "":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\ja-jp\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /grant "":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\uk-ua\user32.dll.mui" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /grant "":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\drivers\tcpip.sys" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /grant "Admin":f"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /C ""C:\Windows\system32\takeown.exe" /F "C:\Windows\rescache" /A&"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /reset&"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /grant "Admin":f"

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\de-de\user32.dll.mui" /A

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\en-us\user32.dll.mui" /A

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /reset

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\ja-jp\user32.dll.mui" /A

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\fr-fr\user32.dll.mui" /A

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\drivers\tcpip.sys" /A

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\de-de\user32.dll.mui" /grant "":f

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\rescache" /A

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\es-es\user32.dll.mui" /A

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\it-it\user32.dll.mui" /A

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /reset

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /reset

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /reset

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /reset

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\ja-jp\user32.dll.mui" /grant "":f

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\it-it\user32.dll.mui" /grant "":f

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /reset

C:\Windows\system32\takeown.exe

"C:\Windows\system32\takeown.exe" /F "C:\Windows\System32\uk-ua\user32.dll.mui" /A

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\fr-fr\user32.dll.mui" /grant "":f

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\rescache" /grant "Admin":f

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\en-us\user32.dll.mui" /grant "":f

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /reset

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /reset

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /reset

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\drivers\tcpip.sys" /grant "Admin":f

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\es-es\user32.dll.mui" /grant "":f

C:\Windows\system32\icacls.exe

"C:\Windows\system32\icacls.exe" "C:\Windows\System32\uk-ua\user32.dll.mui" /grant "":f

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://half-open.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabe0446f8,0x7ffabe044708,0x7ffabe044718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,14334908941739313457,14180323922232030651,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	28.118.140.52.in-addr.arpa	udp
US	8.8.8.8:53	82.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.237:443	g.bing.com	tcp
US	8.8.8.8:53	67.31.126.40.in-addr.arpa	udp
NL	23.62.61.194:443	www.bing.com	tcp
US	8.8.8.8:53	237.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	58.99.105.20.in-addr.arpa	udp
US	8.8.8.8:53	194.61.62.23.in-addr.arpa	udp
US	8.8.8.8:53	half-open.com	udp
RU	81.177.139.61:80	half-open.com	tcp
RU	81.177.139.61:80	half-open.com	tcp
GB	142.250.200.2:80	pagead2.googlesyndication.com	tcp
US	8.8.8.8:53	googleads.g.doubleclick.net	udp
GB	142.250.180.2:443	googleads.g.doubleclick.net	tcp
US	8.8.8.8:53	61.139.177.81.in-addr.arpa	udp
US	8.8.8.8:53	2.200.250.142.in-addr.arpa	udp
US	8.8.8.8:53	2.180.250.142.in-addr.arpa	udp
US	8.8.8.8:53	tpc.googlesyndication.com	udp
GB	172.217.16.225:443	tpc.googlesyndication.com	tcp
US	8.8.8.8:53	225.16.217.172.in-addr.arpa	udp
US	8.8.8.8:53	74.204.58.216.in-addr.arpa	udp
GB	172.217.16.225:443	tpc.googlesyndication.com	udp
US	8.8.8.8:53	www.half-open.com	udp
RU	81.177.139.61:80	www.half-open.com	tcp
US	8.8.8.8:53	195.212.58.216.in-addr.arpa	udp
US	8.8.8.8:53	99.201.58.216.in-addr.arpa	udp
US	8.8.8.8:53	232.168.11.51.in-addr.arpa	udp
N/A	224.0.0.251:5353		udp
US	8.8.8.8:53	86.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	198.187.3.20.in-addr.arpa	udp
US	8.8.8.8:53	107.12.20.2.in-addr.arpa	udp
US	8.8.8.8:53	91.90.14.23.in-addr.arpa	udp
US	8.8.8.8:53	57.169.31.20.in-addr.arpa	udp
US	8.8.8.8:53	14.227.111.52.in-addr.arpa	udp
US	8.8.8.8:53	0.204.248.87.in-addr.arpa	udp
US	8.8.8.8:53	tse1.mm.bing.net	udp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	150.171.28.10:443	tse1.mm.bing.net	tcp
US	8.8.8.8:53	88.156.103.20.in-addr.arpa	udp
US	8.8.8.8:53	10.28.171.150.in-addr.arpa	udp
US	8.8.8.8:53	10.179.89.13.in-addr.arpa	udp

Files

memory/3116-0-0x0000000000400000-0x00000000004C8000-memory.dmp

memory/3116-1-0x0000000002380000-0x0000000002381000-memory.dmp

C:\Windows\System32\de-DE\user32new.dll.mui

MD5	f8d6dd4349b7f240c6cd4d04d21657f7
SHA1	744e7220be770ddce55fc6242fa3c5547725fcd7
SHA256	bd2c70e7e8720942b4bc3020929b894bfbe5e9d97082a821272b73f5d480e9b3
SHA512	96f3e427b735a63b49c07e7f14754b996324a58cc15cf99e55c1ba1555dfdbeb7734719b06d4a95c322b3a9bb31c0bb192d78b06981c03ba0678538dd4890f4f

C:\Windows\System32\en-US\user32new.dll.mui

MD5	90b43ec7eb2e379561b0efd0d93342bb
SHA1	efdc5321144229a02e2347ae71ef1e9a869d8d3c
SHA256	6921a8d82bd3586df770d2854dc9c538f6de996a64c63c29e31b1e84be040f4a
SHA512	5cc5f9045c90e8fd7d0ddbc242ef64df71b10e36c3a6e5d25db8dbc2608aa3ec48b2a6b71686fa4646e40eefec700e0b2c324e8bde7da9239be98f1416a58e4e

C:\Windows\System32\es-ES\user32new.dll.mui

MD5	88e058f2f65a9ecfc4023f5d6512bfee
SHA1	c3a86890e1560d33309c0e019d573855028a811b
SHA256	a0fc551bc1fe60ecedc79c387a3311f9879d1f69509e61c6a6e472534d7b4448
SHA512	e51ac8a044bd5a0de3eb5128efccaa04ee54c5578c698b00bef3ffd9094e51e550b757916af4e7992407019614fd816dd9d78231b6821813bf3e9b4e217f807d

C:\Windows\System32\it-IT\user32new.dll.mui

MD5	c99c413b13017aa89431469764aab8cd
SHA1	a556fc89f96414c3d2b262841b207065a5e205c9
SHA256	da174e40ddc8260b809f6331a2d3aa37daa108acd09aef38048432bd1ca283f7
SHA512	da93ae0f081900c612c66967c27baf19b2d2054462971887d295b3db3ca5c1e5dbfd92bd258c4acc683b7ea3414466ded4d6ae85464a4eca7e08029fb4c1d615

C:\Windows\System32\fr-FR\user32new.dll.mui

MD5	3996e9a5f0cc85e93aa7ade49a892c5e
SHA1	fa2b4d88bc4b2efb7acd13a83003ec23c44c2664
SHA256	39519ade42cac753b5fd8586786e292ada3c4910041353b31730fa3079801c21
SHA512	99a84f565c0c730472ebb7940c260460f54b1c88c446c3869ce5e889f4fd14230b40c6267de751d93a3e1882d6ac6cd29a6026591aebb3600caa7b508bd5d414

C:\Windows\System32\ja-jp\user32new.dll.mui

MD5	e69bdd36a3eb328b1af034c72f160495
SHA1	7615ada4ae284c46dd7ae5212e336aef597814ca
SHA256	9c8c73bd07a703b1561e611e8e0754e3070aca9780069016061986550c3da772
SHA512	f6fb9b3936b856548d2a728506898556048e0708be7803b50a12063db39943f9ebb5013a8f670e3e1c2ce1f4865b7cc6470c3b87bc01957b8749305cc4cc2ec8

C:\Windows\System32\uk-UA\user32new.dll.mui

MD5	aa12a3301c30a46acd35972b04c0a71f
SHA1	56a6a8b5f74e1bddb382f70e8fafa84d2313e364
SHA256	4d8dadf1c2659434290a2e304f9e87a1bd7de443ec8c7599d44d6f9e1636e77e
SHA512	cd64db81fcc2129b73c864bc63f987b447b7c1cea3194bd48f9aa34fb905617e72c585885f3dc071063a08b760bb75ef57f0ae2bca261435c567b4ce8e6f80c3

memory/3116-124-0x0000000000400000-0x00000000004C8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	c39b3aa574c0c938c80eb263bb450311
SHA1	f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA256	66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512	eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

\??\pipe\LOCAL\crashpad_4320_HLTKBFDRBXUQPHTE

MD5	d41d8cd98f00b204e9800998ecf8427e
SHA1	da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256	e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512	cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5	dabfafd78687947a9de64dd5b776d25f
SHA1	16084c74980dbad713f9d332091985808b436dea
SHA256	c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512	dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	44c502709f99b8389b5ddbcf49c11865
SHA1	4cbce8e99fe2816134c9c81c57dcf5a5cb23f175
SHA256	83b8a5d7774541a77b492d5350ede6cb4516926530831a1b76563a80163011a3
SHA512	f5d835f35938fd6466f7caead29bcc2e5a7611c39f8219e4a2447ae9e59682dbac70b2f927d5ed11151d3ae971935820bdf5a9b2c7fc14858f5c67af63d2e5cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5	6752a1d65b201c13b62ea44016eb221f
SHA1	58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256	0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512	9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5	e33e35f71221d8b8f5827d8d951ee176
SHA1	18903c3a3d9e7e4e96385b9cb0d78ef087ece1b8
SHA256	6e921610f7c39a9db45c25f1d5d59906b449e82fb5d0a2fcbc4f8dbba32d7e7e
SHA512	7b7fb3522e0daca459a17857d93a2f6ab4c69b9b3b8a8ce922cc8c3cd6144a2593ed456988b8799616a9398fafeb1be14611d22a39b7be82c575fa8fd084d128

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5	8fa62fede32216e0a4113d259982f89e
SHA1	b53c005a9d75289b698b15e4c853f9c2b6cae5ad
SHA256	ef0943c95eae441209447db9b229d89eed1599cd8e66166c8d584bef39e15997
SHA512	313c173af97f93f0ca09b2ab0f4f13cafcc8e540ae2ca29497fb06e089726284a313ad736ed0f5f2a380600e285199ef8e90a29dfebfe7c62771c8fd752186c6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5	afc1565dde920d0818f4d86822b89168
SHA1	8cc34419b0c846ded7b03a83b78d252f23e555c1
SHA256	69bbccfff19ffeeb3e993373d88f9f7409d85ec6d96c7c5556a732ffd0350f2f
SHA512	17cb542a44616ae0c292c185a79cbe1967d5d26ff6bfdd8a36a61c91d5978cf2a0e57b98ebc8629739023dc1b7df0628cb34c1521a16637bd969e94879e7e6ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5	b3636fd09e4cdf221662df3d176c42a2
SHA1	ee9964491509a596007c5b26e11b396510c9bfc8
SHA256	8260b8b12c3aac8516a34842bb766bf6cec40efb3fa4fefb5a43187f0185a56d
SHA512	391ff2610ce4ee34bac809f5f73c28a83e6f7d5160cf7297ad59d61d812b0d7b919e5beaf4f70a9bd7fa69f45a425d839c67bd0ff7b54112d4e5933f656455dd

Sample ID	240702-vgz5hascrf
Target	201b3ddbaeaa3cc5f7480d8fe72fc567_JaffaCakes118
SHA256	95a8e22f4586b962c8bbe268f28b9561ecfafc06bee75f3571ced253d66d5531
Tags	spyware stealer upx defense_evasion discovery exploit

Malware Analysis Report

2024-09-11 05:43

Table of Contents