Analysis
-
max time kernel
516s -
max time network
864s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/03/2025, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240903-en
windows7-x64
31 signatures
900 seconds
General
-
Target
sample.html
-
Size
3KB
-
MD5
8f42ccb443b9a6b53c6dc09a7eb26775
-
SHA1
2349df6e48fcba4e6b8994403d01f3f02899e200
-
SHA256
3f5996cd1014590af1a91a9b3c711cdefaabcb93e8b7399ebb801cc7f7cee762
-
SHA512
2621d678cf76c61e1c800e3b03706423840d6a93f22b7945364a43c441b43fe3a2ab34a040102fa36c082bc7730395fdef2dc5db2ebae5efa844ffa89ebe77fa
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:7000
Attributes
-
Install_directory
%AppData%
-
install_file
Vlc Runtime.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/2176-2572-0x0000000000D40000-0x0000000000D5C000-memory.dmp family_xworm -
Xworm family
-
Download via BitsAdmin 1 TTPs 1 IoCs
pid Process 2476 bitsadmin.exe -
Downloads MZ/PE file 1 IoCs
flow pid Process 205 2624 chrome.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 1304 7z2409-x64.exe 1440 7zFM.exe 900 Xworm V5.6.exe 2188 7z2409-x64.exe 2720 Xworm V5.6.exe 2176 VLC Runtime.exe 3068 7zFM.exe 628 server.exe 2220 SERVER.EXE 2700 Win32.dII 852 Win32.dII 1056 Win32.dII 1764 Win32.dII 3004 Win32.dII 1408 Win32.dII 2884 Win32.dII 1060 Win32.dII 768 Win32.dII 2868 Win32.dII 564 Win32.dII 1352 Win32.dII 1164 Win32.dII 2216 Win32.dII 1600 Win32.dII 1604 Win32.dII 1292 Win32.dII 696 Win32.dII 2820 Win32.dII 896 Win32.dII 2176 Win32.dII 2964 Win32.dII 1780 Win32.dII 2564 Win32.dII 2524 Win32.dII 2312 Win32.dII 1680 Win32.dII 2084 Win32.dII 1784 Win32.dII 2192 Win32.dII 2344 Win32.dII 1284 Win32.dII 2112 Win32.dII 1156 Win32.dII 3052 Win32.dII 2092 Win32.dII 572 Win32.dII 3040 Win32.dII 1096 Win32.dII 2924 Win32.dII 2600 Win32.dII 2492 Win32.dII 2432 Win32.dII 2648 Win32.dII 1848 Win32.dII 2992 Win32.dII 540 Win32.dII 1860 Win32.dII 2612 Win32.dII 2204 Win32.dII 2984 Win32.dII 1808 Win32.dII 1916 Win32.dII 1328 Win32.dII 1044 Win32.dII -
Loads dropped DLL 64 IoCs
pid Process 1304 7z2409-x64.exe 1304 7z2409-x64.exe 1304 7z2409-x64.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 1440 7zFM.exe 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 3068 7zFM.exe 2220 SERVER.EXE 2220 SERVER.EXE 2700 Win32.dII -
Uses the VBS compiler for execution 1 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 48 IoCs
flow ioc 435 camo.githubusercontent.com 438 camo.githubusercontent.com 75 camo.githubusercontent.com 109 camo.githubusercontent.com 372 raw.githubusercontent.com 439 camo.githubusercontent.com 448 camo.githubusercontent.com 479 raw.githubusercontent.com 369 raw.githubusercontent.com 371 raw.githubusercontent.com 169 raw.githubusercontent.com 268 camo.githubusercontent.com 283 camo.githubusercontent.com 302 raw.githubusercontent.com 363 raw.githubusercontent.com 408 camo.githubusercontent.com 162 raw.githubusercontent.com 170 raw.githubusercontent.com 249 camo.githubusercontent.com 424 camo.githubusercontent.com 425 camo.githubusercontent.com 436 camo.githubusercontent.com 449 camo.githubusercontent.com 138 raw.githubusercontent.com 147 raw.githubusercontent.com 297 raw.githubusercontent.com 362 raw.githubusercontent.com 422 camo.githubusercontent.com 447 camo.githubusercontent.com 476 raw.githubusercontent.com 74 camo.githubusercontent.com 168 raw.githubusercontent.com 301 raw.githubusercontent.com 407 camo.githubusercontent.com 409 camo.githubusercontent.com 475 raw.githubusercontent.com 135 raw.githubusercontent.com 165 raw.githubusercontent.com 298 raw.githubusercontent.com 359 raw.githubusercontent.com 406 camo.githubusercontent.com 450 camo.githubusercontent.com 478 raw.githubusercontent.com 134 raw.githubusercontent.com 145 raw.githubusercontent.com 358 raw.githubusercontent.com 368 raw.githubusercontent.com 423 camo.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 219 ip-api.com -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII SERVER.EXE File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII File created C:\Windows\SysWOW64\Win32.dII Win32.dII -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\tk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\readme.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2409-x64.exe File created C:\Program Files\7-Zip\7-zip.dll 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\descript.ion 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 7z2409-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2409-x64.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\SERVER.EXE server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SERVER.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language server.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mshta.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Win32.dII -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Xworm V5.6.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Xworm V5.6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Xworm V5.6.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://niggafart.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLsTime iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c84c6d3b2b5dd148a097aac550ad8cf00000000002000000000010660000000100002000000064c17bceab6ccc3069cbecbf63c1a61415b91653e4430aa19a25c2204ba94e63000000000e80000000020000200000003476fb8cbecbae89ed35935a0b7382b59c59b3ce12aa1f2de2f871c0f5d9356790000000f5ea01fc93c8631bfd4c36d287f1797069326fcf3576f2ea615285e415488d849406f4e5d37ba3c6ca3475fd856c7b3b40036e0b8af91cf998986482632903834aede2997439b17f1f9dfef55e96f648ccb6749a18d2f75f30ffef004e990bc056fd7f354c8120211f25e1f4d586e0f39ba6633f71fcf707c6d6c05209a00d0285c93efb2a9ab9a36c2902404ce2bfc14000000052fdbb19947b2db1515fcbd80c507b884d8095a4d40b20ef1d498d85236611a927257e78acee99663910196eebf8e2606ad9c391441a1164ec24a06a70a44ac0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72A124F1-FC3E-11EF-B432-C6DA928D33CD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLs iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLs\url2 = "https://www.facebook.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f62a3b4b90db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "447614929" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url1 = 10bb093b4b90db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url3 = 0000000000000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c84c6d3b2b5dd148a097aac550ad8cf000000000020000000000106600000001000020000000d75d7ff6c09a3b5fe5bb3dcbae83f3bd2e15db918b4c8469670f85f10c12fdea000000000e800000000200002000000053711fa23bd7bfdd15cd83e021693f4774d1ae7dcba74f76f13526f4a70544f0200000005efbe49d3eeb9cf5ea39b8a009f28bce397318159f2574eb526a3e45b4f8a15b40000000c83ddf0b699a6a3fc7a50efe55c0c7a0353bfffe5a98ed0286cebd1f361754221935a1d479424b64b8f02f4e4f8c11989a67ffe996a95824aa9437fa50b02741 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon\ = "c:\\windows\\SYSTEM\\shell32.dll,-154" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\ = "dIIfile" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" SERVER.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\ = "dIIfile" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\ = "dIIfile" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon\ = "c:\\windows\\SYSTEM\\shell32.dll,-154" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2409-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Xworm V5.6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 4c003100000000002359ca2e100041646d696e00380008000400efbe2359ab292359ca2e2a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000 Xworm V5.6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon\ = "c:\\windows\\SYSTEM\\shell32.dll,-154" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2409-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.dII\Content Type = "application/x-msdownload" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon\ = "c:\\windows\\SYSTEM\\shell32.dll,-154" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\Shell\open\command\ = "\"%1\" %*" Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon\ = "c:\\windows\\SYSTEM\\shell32.dll,-154" Win32.dII Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dII Win32.dII Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\dIIfile\DefaultIcon\ = "c:\\windows\\SYSTEM\\shell32.dll,-154" Win32.dII -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1440 7zFM.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 3068 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
pid Process 2684 rundll32.exe 1440 7zFM.exe 2720 Xworm V5.6.exe 3068 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 2224 IEXPLORE.EXE Token: SeIncBasePriorityPrivilege 2224 IEXPLORE.EXE Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe Token: SeShutdownPrivilege 1852 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1548 iexplore.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1440 7zFM.exe 1440 7zFM.exe 1440 7zFM.exe 1440 7zFM.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 1852 chrome.exe 2720 Xworm V5.6.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 1548 iexplore.exe 1548 iexplore.exe 2224 IEXPLORE.EXE 2224 IEXPLORE.EXE 1548 iexplore.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe 2720 Xworm V5.6.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 2224 1548 iexplore.exe 31 PID 1548 wrote to memory of 2224 1548 iexplore.exe 31 PID 1548 wrote to memory of 2224 1548 iexplore.exe 31 PID 1548 wrote to memory of 2224 1548 iexplore.exe 31 PID 1852 wrote to memory of 2136 1852 chrome.exe 34 PID 1852 wrote to memory of 2136 1852 chrome.exe 34 PID 1852 wrote to memory of 2136 1852 chrome.exe 34 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 900 1852 chrome.exe 36 PID 1852 wrote to memory of 2624 1852 chrome.exe 37 PID 1852 wrote to memory of 2624 1852 chrome.exe 37 PID 1852 wrote to memory of 2624 1852 chrome.exe 37 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 PID 1852 wrote to memory of 1612 1852 chrome.exe 38 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6599758,0x7fef6599768,0x7fef65997782⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:22⤵PID:900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵
- Downloads MZ/PE file
PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1536 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2240 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2252 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3172 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:22⤵PID:1676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1368 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3380 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3496 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3384 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3680 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3464 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3428 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3868 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:1648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=1860 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4112 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4264 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=4388 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4492 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4280 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4628 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=3932 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=1716 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=1068 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4480 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4428 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4172 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4436 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4172 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1096
-
-
C:\Users\Admin\Downloads\7z2409-x64.exe"C:\Users\Admin\Downloads\7z2409-x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:1304
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\XWorm V5.6.7z2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2684 -
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\XWorm V5.6.7z"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\7zO0A57F5D9\Xworm V5.6.exe"C:\Users\Admin\AppData\Local\Temp\7zO0A57F5D9\Xworm V5.6.exe"4⤵
- Executes dropped EXE
PID:900 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 900 -s 7285⤵PID:1936
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=1308 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=3312 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:1636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=4132 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:12⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=1228,i,12104505986784438174,2629583003449015365,131072 /prefetch:82⤵PID:1596
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\LittleBusters 2.10.7z"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\7zOCFB5817E\server.exe"C:\Users\Admin\AppData\Local\Temp\7zOCFB5817E\server.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:628 -
C:\Windows\SERVER.EXE"C:\Windows\SERVER.EXE"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2220 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII6⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:852 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII7⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1408 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII11⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2884 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII13⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:768 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII14⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2868 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII15⤵
- Executes dropped EXE
PID:564 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII16⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1352 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII17⤵
- Executes dropped EXE
PID:1164 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII19⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII20⤵
- Executes dropped EXE
PID:1604 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII21⤵
- Executes dropped EXE
PID:1292 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII22⤵
- Executes dropped EXE
PID:696 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII23⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2820 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII24⤵
- Executes dropped EXE
PID:896 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII25⤵
- Executes dropped EXE
PID:2176 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII26⤵
- Executes dropped EXE
- Modifies registry class
PID:2964 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1780 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2564 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII29⤵
- Executes dropped EXE
PID:2524 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2312 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII31⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII32⤵
- Executes dropped EXE
- Modifies registry class
PID:2084 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII33⤵
- Executes dropped EXE
- Modifies registry class
PID:1784 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII35⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII37⤵
- Executes dropped EXE
- Modifies registry class
PID:2112 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII38⤵
- Executes dropped EXE
- Modifies registry class
PID:1156 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3052 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII40⤵
- Executes dropped EXE
- Modifies registry class
PID:2092 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:572 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3040 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1096 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII44⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2924 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII45⤵
- Executes dropped EXE
PID:2600 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2492 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII47⤵
- Executes dropped EXE
- Modifies registry class
PID:2432 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:2648 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1848 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII50⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2992 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII51⤵
- Executes dropped EXE
- Modifies registry class
PID:540 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII52⤵
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII53⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2612 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII54⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII55⤵
- Executes dropped EXE
PID:2984 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1808 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII58⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1328 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII60⤵PID:964
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII61⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2816 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII62⤵
- Drops file in System32 directory
- Modifies registry class
PID:596 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII63⤵
- Drops file in System32 directory
PID:1708 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII64⤵
- System Location Discovery: System Language Discovery
PID:3036 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII65⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2412 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII66⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII67⤵PID:1648
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII68⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:776 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII69⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII70⤵
- Modifies registry class
PID:1100 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII71⤵PID:1052
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII72⤵PID:1816
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII73⤵
- Modifies registry class
PID:2232 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII74⤵
- Drops file in System32 directory
PID:304 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII75⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2980 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII76⤵PID:3000
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII77⤵PID:2532
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII78⤵
- Drops file in System32 directory
PID:2244 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII79⤵
- System Location Discovery: System Language Discovery
PID:2752 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII80⤵PID:2408
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII81⤵
- Drops file in System32 directory
PID:352 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII82⤵
- System Location Discovery: System Language Discovery
PID:2080 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII83⤵
- System Location Discovery: System Language Discovery
PID:2896 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII84⤵
- System Location Discovery: System Language Discovery
PID:1712 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII85⤵
- Modifies registry class
PID:2512 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII86⤵
- Drops file in System32 directory
PID:1664 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII87⤵
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII88⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII89⤵PID:2440
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII90⤵PID:2836
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII91⤵PID:2076
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII92⤵
- Modifies registry class
PID:2448 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII93⤵PID:3008
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII94⤵
- Drops file in System32 directory
PID:2404 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII95⤵
- Drops file in System32 directory
- Modifies registry class
PID:1040 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII96⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:444 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII97⤵
- Drops file in System32 directory
PID:2628 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII98⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:316 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII99⤵
- Drops file in System32 directory
- Modifies registry class
PID:1032 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII100⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:340 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII101⤵PID:2548
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII102⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2004 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII103⤵PID:2900
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII104⤵PID:1924
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII105⤵
- Drops file in System32 directory
- Modifies registry class
PID:2572 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII106⤵
- System Location Discovery: System Language Discovery
PID:2336 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII107⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2764 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII108⤵
- System Location Discovery: System Language Discovery
PID:708 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII109⤵PID:1508
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII110⤵
- Drops file in System32 directory
- Modifies registry class
PID:3016 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII111⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1596 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII112⤵
- Modifies registry class
PID:3020 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII113⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII114⤵PID:996
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII115⤵PID:952
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII116⤵PID:1016
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII117⤵PID:1768
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII118⤵PID:2776
-
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII119⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1592 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII120⤵
- Drops file in System32 directory
- Modifies registry class
PID:1640 -
C:\Windows\SysWOW64\Win32.dIIC:\Windows\system32\Win32.dII121⤵
- Drops file in System32 directory
PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-