blackmoon | 4a94cb3b8694baaa65d24769fcccf890c8dfd3a8ce2e187bed58b926563c1cdc

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a94cb3b8694baaa65d24769fcccf890c8dfd3a8ce2e187bed58b926563c1cdc.msi
Size

35.8MB
MD5

09e49ede1ae81b8193683bdb8a74394c
SHA1

f1ba4ab8c9f5cf3a6f4642e4e1e5f100bc50a939
SHA256

4a94cb3b8694baaa65d24769fcccf890c8dfd3a8ce2e187bed58b926563c1cdc
SHA512

11e4dbc34573c66de90b9a2785fd7b85c4931ce86bd2001bf86d7a5869835b3ebc7c2ed0cfee6731ec8acd58195470db46d43c5ea473e44e569ad1438e9164d5
SSDEEP

786432:bMf7E/aq2GdHnewtdV5Kout5tyDQuA6xGbdu91PLu6Oimm/Kc5:bOA/aq7lnewtdVFK5tykoxYgDvmm/l5

Score

10^/10

blackmoon banker bootkit discovery evasion execution persistence privilege_escalation themida trojan

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
behavioral2/memory/440-88-0x0000000010000000-0x0000000010C14000-memory.dmp	family_blackmoon

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LineAppMgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LINE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LINE.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4392	powershell.exe
1908	powershell.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LINE.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pwBQBmGf.lnk	msiexec.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JTfaHabS.lnk	msiexec.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0007000000023c80-367.dat	themida
behavioral2/memory/4520-376-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp	themida
behavioral2/memory/4520-377-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp	themida
behavioral2/memory/4520-378-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp	themida
behavioral2/memory/4520-381-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp	themida

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	wegame.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	LineUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	LineLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	LineLauncher.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
440	DcaHVfBh.exe
1404	DcaHVfBh.exe
440	DcaHVfBh.exe
1404	DcaHVfBh.exe
4520	LineAppMgr.exe
5008	LINE.exe
4152	LINE.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	LINE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	LINE.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\zBBYPStb\Lua51.dll	msiexec.exe
File created	C:\Program Files (x86)\zBBYPStb\beacon_sdk.dll	msiexec.exe
File created	C:\Program Files (x86)\zBBYPStb\vcruntime140.dll	msiexec.exe
File created	C:\Program Files (x86)\YmhwJCFq\msvcp100.dll	msiexec.exe
File created	C:\Program Files (x86)\YmhwJCFq\DcaHVfBh.exe	msiexec.exe
File created	C:\Program Files (x86)\zBBYPStb\wegame.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\zBBYPStb\log\wegame.mem.log	wegame.exe
File created	C:\Program Files (x86)\YmhwJCFq\libcurl.dll	DcaHVfBh.exe
File created	C:\Program Files (x86)\YmhwJCFq\log.txt	DcaHVfBh.exe
File created	C:\Program Files (x86)\YmhwJCFq\libcurl.dll	msiexec.exe
File created	C:\Program Files (x86)\YmhwJCFq\msvcr100.dll	msiexec.exe
File created	C:\Program Files (x86)\YmhwJCFq\User.ini	DcaHVfBh.exe
File created	C:\Program Files (x86)\YmhwJCFq\fwWSwdnN.exe	msiexec.exe
File created	C:\Program Files (x86)\zBBYPStb\adapt_for_imports.dll	msiexec.exe
File created	C:\Program Files (x86)\zBBYPStb\common.dll	msiexec.exe
File created	C:\Program Files (x86)\zBBYPStb\msvcp140.dll	msiexec.exe
File created	C:\Program Files (x86)\zBBYPStb\log\wegame.20241119-141202-629.log	wegame.exe
File created	C:\Program Files (x86)\YmhwJCFq\1	msiexec.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE177.tmp	msiexec.exe
File created	C:\Windows\Installer\e57dfe0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e57dfe0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BA7B430D-0A40-4095-A200-4FD86E8E4027}	msiexec.exe

Executes dropped EXE 12 IoCs

pid	Process
4488	wegame.exe
1404	DcaHVfBh.exe
440	DcaHVfBh.exe
3240	fwWSwdnN.exe
4628	wegame.exe
964	LineInst_240648140.exe
4520	LineAppMgr.exe
3716	LineLauncher.exe
5008	LINE.exe
4008	LineUpdater.exe
2236	LineLauncher.exe
4152	LINE.exe

Loads dropped DLL 64 IoCs

pid	Process
4628	wegame.exe
4628	wegame.exe
4628	wegame.exe
4628	wegame.exe
4488	wegame.exe
4488	wegame.exe
4488	wegame.exe
440	DcaHVfBh.exe
4628	wegame.exe
440	DcaHVfBh.exe
4488	wegame.exe
4488	wegame.exe
1404	DcaHVfBh.exe
1404	DcaHVfBh.exe
4628	wegame.exe
4488	wegame.exe
440	DcaHVfBh.exe
1404	DcaHVfBh.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
4520	LineAppMgr.exe
4520	LineAppMgr.exe
4520	LineAppMgr.exe
4520	LineAppMgr.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
5008	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LINE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LINE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2744	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineInst_240648140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DcaHVfBh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wegame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fwWSwdnN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wegame.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DcaHVfBh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineLauncher.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e3c1c56297b3270b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e3c1c5620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e3c1c562000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de3c1c562000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e3c1c56200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wegame.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wegame.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wegame.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wegame.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wegame.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LINE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LINE.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\",0"	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\shell\open	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\shell\open\	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\URL Protocol	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\URL Protocol	LineInst_240648140.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{E9E68E7A-AC3C-43F4-84D2-375A31ECB9F3}	LINE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\shell\	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\shell\open\	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\shell\open	LineInst_240648140.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{320689A6-C140-4018-AC44-BEFD4C97B5C6}	LINE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\ = "URL:LINE Protocol"	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\shell\open\command	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\DefaultIcon	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\",0"	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\shell	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LineInst_240648140.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{3579789D-1AAE-4F51-A7F4-C543A648A77D}	LINE.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\shell	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\ = "URL:LINE Protocol"	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\shell\	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\line\shell\open\command	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LINE.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb	LineInst_240648140.exe
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\DefaultIcon	LineInst_240648140.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\lineb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LineInst_240648140.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4089630652-1596403869-279772308-1000\{E6A3163C-6896-4863-9883-395931937A81}	LINE.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5008	LINE.exe
4152	LINE.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2984	msiexec.exe
2984	msiexec.exe
4488	wegame.exe
4488	wegame.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
1404	DcaHVfBh.exe
1404	DcaHVfBh.exe
1404	DcaHVfBh.exe
1404	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
1908	powershell.exe
1908	powershell.exe
4392	powershell.exe
4392	powershell.exe
1908	powershell.exe
4392	powershell.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe
440	DcaHVfBh.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2744	msiexec.exe
Token: SeSecurityPrivilege	2984	msiexec.exe
Token: SeCreateTokenPrivilege	2744	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2744	msiexec.exe
Token: SeLockMemoryPrivilege	2744	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2744	msiexec.exe
Token: SeMachineAccountPrivilege	2744	msiexec.exe
Token: SeTcbPrivilege	2744	msiexec.exe
Token: SeSecurityPrivilege	2744	msiexec.exe
Token: SeTakeOwnershipPrivilege	2744	msiexec.exe
Token: SeLoadDriverPrivilege	2744	msiexec.exe
Token: SeSystemProfilePrivilege	2744	msiexec.exe
Token: SeSystemtimePrivilege	2744	msiexec.exe
Token: SeProfSingleProcessPrivilege	2744	msiexec.exe
Token: SeIncBasePriorityPrivilege	2744	msiexec.exe
Token: SeCreatePagefilePrivilege	2744	msiexec.exe
Token: SeCreatePermanentPrivilege	2744	msiexec.exe
Token: SeBackupPrivilege	2744	msiexec.exe
Token: SeRestorePrivilege	2744	msiexec.exe
Token: SeShutdownPrivilege	2744	msiexec.exe
Token: SeDebugPrivilege	2744	msiexec.exe
Token: SeAuditPrivilege	2744	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2744	msiexec.exe
Token: SeChangeNotifyPrivilege	2744	msiexec.exe
Token: SeRemoteShutdownPrivilege	2744	msiexec.exe
Token: SeUndockPrivilege	2744	msiexec.exe
Token: SeSyncAgentPrivilege	2744	msiexec.exe
Token: SeEnableDelegationPrivilege	2744	msiexec.exe
Token: SeManageVolumePrivilege	2744	msiexec.exe
Token: SeImpersonatePrivilege	2744	msiexec.exe
Token: SeCreateGlobalPrivilege	2744	msiexec.exe
Token: SeBackupPrivilege	4624	vssvc.exe
Token: SeRestorePrivilege	4624	vssvc.exe
Token: SeAuditPrivilege	4624	vssvc.exe
Token: SeBackupPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeDebugPrivilege	4392	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeBackupPrivilege	1320	srtasks.exe
Token: SeRestorePrivilege	1320	srtasks.exe
Token: SeSecurityPrivilege	1320	srtasks.exe
Token: SeTakeOwnershipPrivilege	1320	srtasks.exe
Token: SeBackupPrivilege	1320	srtasks.exe
Token: SeRestorePrivilege	1320	srtasks.exe
Token: SeSecurityPrivilege	1320	srtasks.exe
Token: SeTakeOwnershipPrivilege	1320	srtasks.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2744	msiexec.exe
2744	msiexec.exe
964	LineInst_240648140.exe
964	LineInst_240648140.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe
4152	LINE.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5008	LINE.exe
4152	LINE.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 1320	2984	msiexec.exe	99
PID 2984 wrote to memory of 1320	2984	msiexec.exe	99
PID 2984 wrote to memory of 1404	2984	msiexec.exe	103
PID 2984 wrote to memory of 1404	2984	msiexec.exe	103
PID 2984 wrote to memory of 1404	2984	msiexec.exe	103
PID 2984 wrote to memory of 4488	2984	msiexec.exe	101
PID 2984 wrote to memory of 4488	2984	msiexec.exe	101
PID 2984 wrote to memory of 4488	2984	msiexec.exe	101
PID 2984 wrote to memory of 4628	2984	msiexec.exe	102
PID 2984 wrote to memory of 4628	2984	msiexec.exe	102
PID 2984 wrote to memory of 4628	2984	msiexec.exe	102
PID 2984 wrote to memory of 440	2984	msiexec.exe	105
PID 2984 wrote to memory of 440	2984	msiexec.exe	105
PID 2984 wrote to memory of 440	2984	msiexec.exe	105
PID 2984 wrote to memory of 3240	2984	msiexec.exe	104
PID 2984 wrote to memory of 3240	2984	msiexec.exe	104
PID 2984 wrote to memory of 3240	2984	msiexec.exe	104
PID 4936 wrote to memory of 4392	4936	cmd.exe	108
PID 4936 wrote to memory of 4392	4936	cmd.exe	108
PID 2312 wrote to memory of 1908	2312	cmd.exe	111
PID 2312 wrote to memory of 1908	2312	cmd.exe	111
PID 3240 wrote to memory of 964	3240	fwWSwdnN.exe	114
PID 3240 wrote to memory of 964	3240	fwWSwdnN.exe	114
PID 3240 wrote to memory of 964	3240	fwWSwdnN.exe	114
PID 964 wrote to memory of 4520	964	LineInst_240648140.exe	116
PID 964 wrote to memory of 4520	964	LineInst_240648140.exe	116
PID 3240 wrote to memory of 3716	3240	fwWSwdnN.exe	118
PID 3240 wrote to memory of 3716	3240	fwWSwdnN.exe	118
PID 3240 wrote to memory of 3716	3240	fwWSwdnN.exe	118
PID 3716 wrote to memory of 5008	3716	LineLauncher.exe	119
PID 3716 wrote to memory of 5008	3716	LineLauncher.exe	119
PID 5008 wrote to memory of 4008	5008	LINE.exe	120
PID 5008 wrote to memory of 4008	5008	LINE.exe	120
PID 5008 wrote to memory of 4008	5008	LINE.exe	120
PID 4008 wrote to memory of 2236	4008	LineUpdater.exe	121
PID 4008 wrote to memory of 2236	4008	LineUpdater.exe	121
PID 4008 wrote to memory of 2236	4008	LineUpdater.exe	121
PID 2236 wrote to memory of 4152	2236	LineLauncher.exe	122
PID 2236 wrote to memory of 4152	2236	LineLauncher.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4a94cb3b8694baaa65d24769fcccf890c8dfd3a8ce2e187bed58b926563c1cdc.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2744

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Program Files (x86)\zBBYPStb\wegame.exe
  "C:\Program Files (x86)\zBBYPStb\wegame.exe"
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\zBBYPStb\wegame.exe
  "C:\Program Files (x86)\zBBYPStb\wegame.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:4628
- C:\Program Files (x86)\YmhwJCFq\DcaHVfBh.exe
  "C:\Program Files (x86)\YmhwJCFq\DcaHVfBh.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Program Files (x86)\YmhwJCFq\fwWSwdnN.exe
  "C:\Program Files (x86)\YmhwJCFq\fwWSwdnN.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Users\Admin\AppData\Local\Temp\LineInst_240648140.exe
    C:\Users\Admin\AppData\Local\Temp\\LineInst_240648140.exe /M
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:964
  - - C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe
      "C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe" -afterinstall
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      PID:4520
- - C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
    C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe
      "C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe" run -t 240669187
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Checks system information in the registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Users\Admin\AppData\Local\LINE\bin\LineUpdater.exe
        
        C:\Users\Admin\AppData\Local/LINE//bin/LineUpdater.exe --deploy 9.4.2.3477 en-US real 0
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4008
      - C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
        
        "C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe" --updated 9.4.2.3477
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\LINE\bin\current\LINE.exe
        
        "C:\Users\Admin\AppData\Local\LINE\bin\current\LINE.exe" run --updated 9.4.2.3477 -t 240684718
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Checks system information in the registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4152
- C:\Program Files (x86)\YmhwJCFq\DcaHVfBh.exe
  "C:\Program Files (x86)\YmhwJCFq\DcaHVfBh.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4624

C:\Windows\system32\cmd.exe
cmd /c start powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
1⤵
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4392

C:\Windows\system32\cmd.exe
cmd /c start powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57dfe3.rbs

Filesize
4KB

MD5
1e8cf7786bf40f166ea72bf128f99b84

SHA1
a536aa3f8153eb555a98d1dae3bfc43e72c5dd80

SHA256
a8de6ed1ee8a56440fddc6076f110f4174355ef06e4616e601f8807db465bf6e

SHA512
4a30df84d6c1862b3784d62a57fc01f5bbd53524fd47a9d8638b95ff5e5cd407e27e0e8965dc6012d3f9c706342ea1efcdc743f22fd923f88d07a6765c63935a

Download Submit
C:\Program Files (x86)\YmhwJCFq\1

Filesize
12.0MB

MD5
1c90e87d055f917136a8e9c6faf65c9c

SHA1
fce1a8f90dfae8cf3fa429425c6510477e58195e

SHA256
6539a6ceb3a1541c13fc9691f49d61320585ac83fd2f465af9a313be24691119

SHA512
11c3f564d032df16ab918c8568bd685af5c2af0a3b91137424222921c4dd567845f4781e4ebcd411d62bd22f7de9382b205c0eaa9440372e5cb2a0431f6ba5fd

Download Submit
C:\Program Files (x86)\YmhwJCFq\DcaHVfBh.exe

Filesize
129KB

MD5
33c56f904fe77363fd5e553f7498854e

SHA1
e0cbe72715bda80c21a9cce8c6b3b76779ed71f3

SHA256
3ee9676a50e1d314a942de5c1fc614f4e00a3143397316a5892daee41f0bac4d

SHA512
8559df54856fc28b382b624a12201fb404a82c2cab7fbe095f8d3883a32177303bf633a14210de1f493fe015b97de5c10d7a10ae0b8561713a925020f840e812

Download Submit
C:\Program Files (x86)\YmhwJCFq\fwWSwdnN.exe

Filesize
1004KB

MD5
587e3bc21efaf428c87331decc9bfeb3

SHA1
a5b8ebeab4e3968673a61a95350b7f0bf60d7459

SHA256
b931c5686cc09b2183bba197dc151b8e95ca6151e39fb98954352340c0b31120

SHA512
ffae2dab5caf16dc7dfd0a97a8ff6349a466bc57ee043d1ac4d53e011498e39b9a855295d10207ba578c6857abebd445d378e83aa2ff6ec247713d81b370d0ca

Download Submit
C:\Program Files (x86)\YmhwJCFq\libcurl.dll

Filesize
19.4MB

MD5
e2699b1b1342d77c0da102e323405cad

SHA1
e5ede2d9d4aca126a3e4ec7a61dd211f35976b99

SHA256
11caa558257f051564c0648ef55cf2d1d83ddc9aa3eb8923db4f33b4dce5604f

SHA512
a86420eb343515a482c01394add7ecd8aaa4ac3979adea2038d6c453b1fa0730e124565659a03a1d540cafe7f21e2480a787acab1f954e30c41ffd45f094c802

Download Submit
C:\Program Files (x86)\YmhwJCFq\msvcp100.dll

Filesize
412KB

MD5
ed40615aa67499e2d2da8389ba9b331a

SHA1
09780d2c9d75878f7a9bb94599f3dc9386cf3789

SHA256
cd28daeda3c8731030e2077e6eccbb609e2098919b05ff310bef8dce1dce2d8d

SHA512
47d94c5f4829a0f901b57084c22b24adefb4aec2f7b8df9ea838e485dbc607aa837ed6d3c7186159499c44a3ff488fb04f770c624649a406854d82cd3baf72ee

Download Submit
C:\Program Files (x86)\YmhwJCFq\msvcr100.dll

Filesize
756KB

MD5
ef3e115c225588a680acf365158b2f4a

SHA1
ecda6d3b4642d2451817833b39248778e9c2cbb0

SHA256
25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8

SHA512
d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a

Download Submit
C:\Program Files (x86)\zBBYPStb\Lua51.dll

Filesize
546KB

MD5
0527df9bdaaea7250291efcb5b33b709

SHA1
1b6b3511c30aa66a0a0258578a4b695db2fbde36

SHA256
7fa367a644670ed94a01bc0927996d93b82ea2658bb7d84c99c648f12b6a61f1

SHA512
d8f49f954112e744b161246759aa0a6b106125a9b936e98c3f57c4535b1e7866adffe3e1699412ef8d549a84121f9492f67bb504b91fffd384bbc2e89611631b

Download Submit
C:\Program Files (x86)\zBBYPStb\adapt_for_imports.dll

Filesize
404KB

MD5
d9f36ff27dc0d08fd384a99bb801a24a

SHA1
886287b85e2b57e05e61ee582dd1595f7e620765

SHA256
96aea19b11327ae4200396e84f06a4746a926f43b688c22e60b370ded1cf6d58

SHA512
032f0f0e6200383dd9a4a7628e1ef5b67ea6fcfd3a872cd2fa0b952ccc3286b10550526c01e0294068e7d3995714efdf798607a51cf4681b8295b8d8493963dd

Download Submit
C:\Program Files (x86)\zBBYPStb\beacon_sdk.dll

Filesize
1.5MB

MD5
c83dd90d61bae5cf1d4b0620649726d6

SHA1
cdb21af237425523d230a1738c4111776b3e8318

SHA256
b5df19432f50ad434ca860173c9eb0dc6fdfaca48f75a3b416d038c213d089da

SHA512
480cb660931eece9fee17fcb60b5c467ceb033d7d2f9fc0cf37b82dbc7443918935ba5a24aaeb8a284c95820eccab382e67342e6f0038c4d36b36f51d04dc412

Download Submit
C:\Program Files (x86)\zBBYPStb\common.dll

Filesize
3.7MB

MD5
856d1285704805940b8379e81b18f3eb

SHA1
aae6852e7f86a8163ca5a63178a7cceb1c50ff67

SHA256
2e21f70adcbe5fe3d51eb9236fc23e071e675c802bfeec2ca5c0a41eef35e9a2

SHA512
50b61c980c176f2f32bd4e353187d5db9f3d3d7d01486105da95d7e7bf153386d2808dc94909b4998e05accebe6cc388ecad8246d236a89529f9a1274b34885c

Download Submit
C:\Program Files (x86)\zBBYPStb\msvcp140.dll

Filesize
438KB

MD5
1fb93933fd087215a3c7b0800e6bb703

SHA1
a78232c352ed06cedd7ca5cd5cb60e61ef8d86fb

SHA256
2db7fd3c9c3c4b67f2d50a5a50e8c69154dc859780dd487c28a4e6ed1af90d01

SHA512
79cd448e44b5607863b3cd0f9c8e1310f7e340559495589c428a24a4ac49beb06502d787824097bb959a1c9cb80672630dac19a405468a0b64db5ebd6493590e

Download Submit
C:\Program Files (x86)\zBBYPStb\vcruntime140.dll

Filesize
78KB

MD5
1b171f9a428c44acf85f89989007c328

SHA1
6f25a874d6cbf8158cb7c491dcedaa81ceaebbae

SHA256
9d02e952396bdff3abfe5654e07b7a713c84268a225e11ed9a3bf338ed1e424c

SHA512
99a06770eea07f36abc4ae0cecb2ae13c3acb362b38b731c3baed045bf76ea6b61efe4089cd2efac27701e9443388322365bdb039cd388987b24d4a43c973bd1

Download Submit
C:\Program Files (x86)\zBBYPStb\wegame.exe

Filesize
1.4MB

MD5
063af51c19f29bcdfd26c1bebdc9ace6

SHA1
810817459e322ba44815df62702b9c8fe04b26fb

SHA256
c6ef12669e1d0a3d0f54ad7cd516d5cf2ddf81edc350c3aafaa51c8ea9226a73

SHA512
5ffff7f49b68004eb8f02522724b45d9c6cfa5cb45ff1c5f3cd93f1c65f0cadc322cc09a777b933c64650a7666c6204b67f9b1adf266ba2d1ce537c17f4a99a9

Download Submit
C:\Users\Admin\AppData\Local\LINE\Data\LINE.ini.lock

Filesize
57B

MD5
f2b5308c62912507e4953b2b77a55e8a

SHA1
d0c204631be03f8a883cfdf1c2dcc660b67cfd9a

SHA256
ae10db5954fb03628990c0d0899e408c9c4f966cf5f2834e71f1400a3615ecfd

SHA512
2a5044106a6155759e5889ed13f6dff7c402b8812cd64811e0a25ab5a793a848af389743d2eb12fd8f62baeeac4941a3a09e9e7895c370d02b4b096430d0f8bf

Download Submit
C:\Users\Admin\AppData\Local\LINE\Data\setting.ini

Filesize
70B

MD5
6e4408192ed51fc11cb10d52f8d2ac20

SHA1
cfa10b840776cf483f3db46bcbf11da7832f22c2

SHA256
1e948e237d17f5ef3d090879d1b05aea99ac0320d70ac9898a4ef1641e181ab0

SHA512
48e0a3d3a1054252f98d84ac77e4530523cc04c3956066a8d663326d1e656b6f0c1087f2e979caa882afd620264470c8fcd9596ebde60ba73f5a7e3b71c32651

Download Submit
C:\Users\Admin\AppData\Local\LINE\Data\setting.ini.TGwvpq

Filesize
93B

MD5
a992d19b034fcf06096625c699cdb291

SHA1
ac3f789f291dd51369631a1e5fa97b5b4e130b55

SHA256
687fb4b1fbbfc5e29206b6172cb9e1a3f4bba1c5262d4ad0b09b957fc0c520bb

SHA512
8118ce39761dcefdbc8c83754f4fbc82e2d8c446c945882319cbf740d28776c2af443ef5417bade37a7b9cda07b56438b9e6381c3e64f34aa1bbb1b96e7955fd

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Line.exe

Filesize
27.8MB

MD5
4ef273b70ab77e96810ef5ca88418635

SHA1
87170abb677522f2ed7ba0dc19efb9149bdd7964

SHA256
6ff874bca4c566e07d8f5ecb62b7efb4ee9208d5b80b6d84caf0cf3b9a34738f

SHA512
3af9d552d6f548a89abe31711d4b482cf98e1f344192d14c2cc1d012930a234f1c94a90becd3a0e9421944def3fe3a3fd55d834d97de631f161e7f281d11d9be

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe

Filesize
3.1MB

MD5
02f554541e0036d6fd7bf2d333b7f0bf

SHA1
6a3f2d00bae392b184c7932f4e394b445ea8223c

SHA256
f822d5ee04cb5afb6c9ddf0a760c50196fb5e3b7221a665ac1329988f6565856

SHA512
53082de34cbf94ce9bc168dcee968f39abb00b88b4f99e327ab03113c508ffb1514b757f86e5bc4e2d3e0b577f9915e5b4675b7b3f154c1ec83565bd4eb69dcc

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineLauncher.exe

Filesize
1.7MB

MD5
a4bad7925d81ce54588a4b35063d0104

SHA1
d3198c1ed0e01610c2e45c13dddf6b3e49c0b4de

SHA256
ae2cc3ce522aa600a177e19a87e21871813977c70d0ca70cbb6cf6cf65f96aba

SHA512
e738a66b81b1cdb552d07ff974666178f94fa80d47dbb5c00994149152e70f53ab140efecec63c3206a68e948756cc6d2ba6c78ca970c56fc93c6cf64243ea85

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineUnInst.exe

Filesize
171KB

MD5
9ffb80552bcc00af65213874d2947463

SHA1
4726923498a8bcc6852e04a29e73f772d562a313

SHA256
be368ba9515ce60af62c64ea13da6c86e8dd9941b5ff2776f1ff013853367266

SHA512
c2f4e1d88f55f17148e22ca38cca91478d0ddad7bc29486327ab2db90365777ae073cdefd347cb36f4aa3b69f31493d69806ddf0b7e0ad8fb277c66e830ad651

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineUpdater.exe

Filesize
3.3MB

MD5
becf6bfcc9667284a88e46869d1bc46b

SHA1
d750e28982db7a1c90dc95d9dc0682a1f07818a5

SHA256
82249727558823b8471e98b3a8c18764d15318b812f1b9524d9040a4ae4f8657

SHA512
aeb54f1f9cdc26e8ffba241e4e185942fa468580102e8af4d4d04699e95e34cda5ee6752b55da30e9bec8031b3b399c1582f11076d3d57deb009fcccf59a4203

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\MSVCP140.dll

Filesize
566KB

MD5
a62a22c33ed01a2cf362d3890ffa70e1

SHA1
ea3f55d92cdcb788876d689d394ec3225b1d222c

SHA256
003da4807acdc912e67edba49be574daa5238bb7acff871d8666d16f8072ff89

SHA512
7da909a6c5dc26631fec8a382d5cb677d3aabf5b5c4e98b545c120685f879adcef8cc98e7bf74d37f7fc24b0f18999780d70aa28061f50adf6b28f19ce06930a

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\VCRUNTIME140_1.dll

Filesize
48KB

MD5
7e668ab8a78bd0118b94978d154c85bc

SHA1
dbac42a02a8d50639805174afd21d45f3c56e3a0

SHA256
e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

SHA512
72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\libcrypto-1_1-x64.dll

Filesize
2.2MB

MD5
2015b36a4ec425de3ffde0153f327b45

SHA1
977fcdd554a9b1455336a426738a5bbf7c5924be

SHA256
3e5ae8ff2bd0cd20656b83bd2e4375b038299cc6a85ef04c255b971d4317bc9c

SHA512
24a560133a0d63db91c5c8adbe2b22fc6bd46ed25b266aa9859ed5548cbf41ef48acd2307b66e479ef7a9fff2e74caed8d238bddc2b69dadc8984ee85712dd46

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\libnelo.dll

Filesize
2.4MB

MD5
b85488da78e6fee382de1726860b5f9a

SHA1
7e96fc54ba5b96bdded6bdf28fe1267133032def

SHA256
77018a7735e434822a2f52656be85546cab93bfd9388b750ebff6aa0a490a649

SHA512
23ec1cc429226a3172c25c1a46a52e02d5d8e1a314fa054dc6d2bb6948d33cfc26ad1f70a3ac7cbd9217226e3d304f84c9f5e066c6269e16b13a2a120592c0ee

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\libssl-1_1-x64.dll

Filesize
628KB

MD5
970996fc9b4cdbb10af6044507d5b7ae

SHA1
0e1b2957753c458ae9596901a6cf3c70839b39ec

SHA256
9fc18a126e7167f422a574a71243e04b9d73be666b24ea7a054822c6dbdf30e4

SHA512
b3a5e6a4ff24e918f2c278643e4b1270c69732199707b6db729b5b6c7d0af30c15c6eebf6a3fb36fe4208d12fa96c7713cbe7a00770233a51deb1b860af18ded

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\vcruntime140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\LineUnInst.exe

Filesize
171KB

MD5
88c2630c8b9788fb41c18f2535c4a2a5

SHA1
b9dec751455ef505690f137571ce2db3ae7ede4b

SHA256
b0d2fc44b42a0d60fba7ad89d535b5c677b9965d3f09d74fc486359267d0cf44

SHA512
3f593583c18fd2b230181118366d009d1c17f4da8a894f65eb979d63337cbb9e3d4331b6d27396d5d872d6be96036703c4a9d1316ef164ea1f4cc5cef39c56f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn2538.tmp\System.dll

Filesize
11KB

MD5
d77839cc52a47e2db7d7fb944643fb0a

SHA1
ed3cd493e5a465a143862df3f280e936f3bd2fac

SHA256
93b73294a24201a4299fd0da7e0ab0dbffa130da300cc3a2c80d2aa7f2da7c77

SHA512
76f2739990bfae391f8c4c7346487150fa70eca82a15adff14e84d83ca03af5b202b8abab139f56b59dffd942a26aacdb359548367be7f80ff6bbf28b973e77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn2538.tmp\UserInfo.dll

Filesize
4KB

MD5
6461ba2b54c2239503eff55de913c437

SHA1
7796499cc23eee4c522be381987913e6c5e8826e

SHA256
4658e40d14895f792cb5ea8bbee7dc95a6bff6478f8e41c3732a66b92fccc0d5

SHA512
12ae466bc824d57d8e44b5a2dca395b98f002fe3cfe4ed544939d7ce5480b174934adf4e9e06ea9d6907e64e180f1b1b6f9d25d607713ca23bb090f1cf3379cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsn2538.tmp\killProc.dll

Filesize
89KB

MD5
b9edf77857f539db509c59673523150a

SHA1
23276a59846d61d0a1826ba3b3f3c4b47b257f20

SHA256
62f8e07d3ba5e9e57aaf529786a92931098f6ee33c6ab5057be5ad4ee0545b31

SHA512
8bedf1ffd4d5f1853e1794e32b7ff482c3c207a8d6600a54d9f0c583feac8711ac70c985f4579a947ee3c686e179dcdf42752bb45da2a5b9254f372265a92f79

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_mdfgeltu.ei2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
6c01d5a210e9efca2e3cc7cf0c4df3ec

SHA1
756d90be4f4a38b1175535f48d2acc27c7ae32c1

SHA256
60fd9877bba3d0cec89ff3beadbc4b56131705301027bf7b4576c741c6865b5d

SHA512
e6a589c3c3d7f26d4e88ab0c4d53924372179787cac7b2cd60e922aeb1bf86e5516f9313a4729b205acb3ca0fbc89fa09540724b654fb6754a0e739fc873fbe8

Download Submit
\??\Volume{62c5c1e3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{017292e3-c41a-4058-b854-caa7e5694019}_OnDiskSnapshotProp

Filesize
6KB

MD5
093b3d396142a50811b7acbbe963a045

SHA1
96e9286881043fb7393e1cc8c94e6974394b6751

SHA256
6abd533d5f6386f664c3568dfb54dee1af90862337410b641026776f1369a8e1

SHA512
ebd3f89f1c65e21de6c894f1cf9bf6d0c20b626a9e677ea82c95853f492c7859b4664867987b992decda850478173f1c12e2189c5b0df16728b54235f866680d

Download Submit
memory/440-88-0x0000000010000000-0x0000000010C14000-memory.dmp

Filesize
12.1MB

Download
memory/440-154-0x0000000072130000-0x0000000073F95000-memory.dmp

Filesize
30.4MB

Download
memory/440-244-0x0000000003290000-0x0000000003475000-memory.dmp

Filesize
1.9MB

Download
memory/440-83-0x0000000072130000-0x0000000073F95000-memory.dmp

Filesize
30.4MB

Download
memory/440-81-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/440-82-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1404-92-0x0000000072130000-0x0000000073F95000-memory.dmp

Filesize
30.4MB

Download
memory/1404-86-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1404-87-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/1908-128-0x000001E29F890000-0x000001E29F8AC000-memory.dmp

Filesize
112KB

Download
memory/1908-141-0x000001E29FAB0000-0x000001E29FABA000-memory.dmp

Filesize
40KB

Download
memory/1908-130-0x000001E29F880000-0x000001E29F88A000-memory.dmp

Filesize
40KB

Download
memory/1908-129-0x000001E29F8B0000-0x000001E29F965000-memory.dmp

Filesize
724KB

Download
memory/1908-100-0x000001E286EB0000-0x000001E286ED2000-memory.dmp

Filesize
136KB

Download
memory/1908-140-0x000001E29FAD0000-0x000001E29FAEC000-memory.dmp

Filesize
112KB

Download
memory/4152-474-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-467-0x00007FFB4E250000-0x00007FFB4E861000-memory.dmp

Filesize
6.1MB

Download
memory/4152-466-0x00007FFB4F0A0000-0x00007FFB4F5E1000-memory.dmp

Filesize
5.3MB

Download
memory/4152-468-0x00007FFB4F0A0000-0x00007FFB4F5E1000-memory.dmp

Filesize
5.3MB

Download
memory/4152-469-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-511-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-470-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-471-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-472-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-473-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-479-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-480-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-478-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-476-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4152-477-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/4392-145-0x000001899F780000-0x000001899F78A000-memory.dmp

Filesize
40KB

Download
memory/4392-144-0x000001899F770000-0x000001899F776000-memory.dmp

Filesize
24KB

Download
memory/4392-143-0x000001899F740000-0x000001899F748000-memory.dmp

Filesize
32KB

Download
memory/4392-142-0x000001899F790000-0x000001899F7AA000-memory.dmp

Filesize
104KB

Download
memory/4520-376-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp

Filesize
8.7MB

Download
memory/4520-381-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp

Filesize
8.7MB

Download
memory/4520-377-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp

Filesize
8.7MB

Download
memory/4520-378-0x00007FF76DBA0000-0x00007FF76E44C000-memory.dmp

Filesize
8.7MB

Download
memory/5008-403-0x00007FFB4EA50000-0x00007FFB4EF91000-memory.dmp

Filesize
5.3MB

Download
memory/5008-447-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-417-0x000001F256DD0000-0x000001F257212000-memory.dmp

Filesize
4.3MB

Download
memory/5008-419-0x000001F257220000-0x000001F257422000-memory.dmp

Filesize
2.0MB

Download
memory/5008-416-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-415-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-414-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-413-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-412-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-411-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-410-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-409-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-408-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-407-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-406-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-405-0x00007FF764EA0000-0x00007FF769B72000-memory.dmp

Filesize
76.8MB

Download
memory/5008-402-0x00007FFB4DFF0000-0x00007FFB4E601000-memory.dmp

Filesize
6.1MB

Download
memory/5008-401-0x00007FFB4EA50000-0x00007FFB4EF91000-memory.dmp

Filesize
5.3MB

Download