adwind | 484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
599s
max time network
604s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863.jar
Size 495KB
Sample260806-ear8baff46
SHA256 484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863
MD5 387f5cedb97aff48c3905a0b5a635604
SHA1 7b8c94ccc84d5f48119af79ff5e47b4fa8d3738c
SHA512 899d8848351d5b7b918a7ed38a610dceb82d8928c1f26d955aa206f0fe9ede1161e93e845adb67372d953ea972cbefc3d8d53a624ba909b6ea5a9e29d861988a
SSDEEP 12288:Ipeb8cFBDLwPHEPrqxXVzqnQOzaO9yHhH7jtvEAv2ODv71Dzbk:eqBQwSYaOIHhHd52sv79k
TLSH
T130B423B9A90C9337E27F2338580178B29CBDC12DE40BD8A5D0A5D336596CEE91F87E51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion execution adwind persistence ransomware spyware trojan

Malware Config

Signatures

Family: AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dragon_updater.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GdBgInx64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ONLINENT.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SSUpdate64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twssrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nfservice.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\op_mon.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamservice.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamTray.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7AVScan.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCShieldCCC.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDFSSvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cavwp.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NS.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiClient.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WebCompanion.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7PSSrvc.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\twsscan.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\acs.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ClamWin.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanosvc.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nanoav.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nnf.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nvcsvc.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANNER.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Medic.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVK.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7TSecurity.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanmon.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BavSvc.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Bav.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDTray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilUp.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\V3Main.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDSC.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\virusutilities.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freshclam.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SUPERAntiSpyware.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreFrameworkHost.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDWelcome.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fmon.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\K7AVScan.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CisTray.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wireshark.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbamscheduler.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FSM32.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FortiSSLVPNdaemon.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserReg.exe\debugger = "svchost.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PtWatchDog.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FilMsg.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\editcap.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BullGuardBhvScanner.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guardxkickoff_x64.exe\debugger = "svchost.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\coreServiceShell.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\econser.exe\debugger = "svchost.exe"	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
2704	javaw.exe

Loads dropped DLL 13 IoCs

pid	Process
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe
2704	javaw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\UHicTHQJfhH = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\jyzlFFZwNRD\\gOJaxIPLBpP.fzXYWv\""	reg.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\test.txt	java.exe
File opened for modification	C:\Windows\System32\test.txt	javaw.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
540	cscript.exe
3756	cscript.exe
4556	cscript.exe
3836	cscript.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5032	cmd.exe
3764	cmd.exe
4568	cmd.exe
4740	cmd.exe
5744	cmd.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
6044	taskkill.exe
4552	taskkill.exe
2976	taskkill.exe
1108	taskkill.exe
3432	taskkill.exe
4092	taskkill.exe
4856	taskkill.exe
3084	taskkill.exe
3652	taskkill.exe
900	taskkill.exe
4788	taskkill.exe
2288	taskkill.exe
3440	taskkill.exe
1188	taskkill.exe
4696	taskkill.exe
1628	taskkill.exe
896	taskkill.exe
4632	taskkill.exe
4796	taskkill.exe
4596	taskkill.exe
1288	taskkill.exe
4332	taskkill.exe
2920	taskkill.exe
5484	taskkill.exe
4452	taskkill.exe
4448	taskkill.exe
2088	taskkill.exe
5220	taskkill.exe
2712	taskkill.exe
4304	taskkill.exe
3432	taskkill.exe
4060	taskkill.exe
2756	taskkill.exe
2504	taskkill.exe
4488	taskkill.exe
1416	taskkill.exe
552	taskkill.exe
4916	taskkill.exe
2916	taskkill.exe
1548	taskkill.exe
4760	taskkill.exe
3520	taskkill.exe
5604	taskkill.exe
2664	taskkill.exe
4956	taskkill.exe
4576	taskkill.exe
3432	taskkill.exe
4788	taskkill.exe
4024	taskkill.exe
4236	taskkill.exe
4080	taskkill.exe
4668	taskkill.exe
2308	taskkill.exe
1612	taskkill.exe
3316	taskkill.exe
4548	taskkill.exe
4248	taskkill.exe
3256	taskkill.exe
5680	taskkill.exe
4808	taskkill.exe
5964	taskkill.exe
3756	taskkill.exe
3492	taskkill.exe
4700	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{CDC5F67F-C8F1-4BF2-87A7-BDFE8D0D0FAD}	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{5328A6F7-95AD-4A1C-93E9-A57D055EB934}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4764	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
5912	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2488	explorer.exe
2488	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	taskkill.exe
Token: SeDebugPrivilege	5680	taskkill.exe
Token: SeDebugPrivilege	4060	taskkill.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	2872	taskkill.exe
Token: SeDebugPrivilege	5380	taskkill.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	4808	taskkill.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	4692	taskkill.exe
Token: SeDebugPrivilege	3256	taskkill.exe
Token: SeDebugPrivilege	1612	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	2592	taskkill.exe
Token: SeDebugPrivilege	4304	taskkill.exe
Token: SeDebugPrivilege	1208	taskkill.exe
Token: SeDebugPrivilege	5096	taskkill.exe
Token: SeDebugPrivilege	2800	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	6060	taskkill.exe
Token: SeDebugPrivilege	4332	taskkill.exe
Token: SeDebugPrivilege	4700	taskkill.exe
Token: SeDebugPrivilege	3088	taskkill.exe
Token: SeDebugPrivilege	2960	taskkill.exe
Token: SeDebugPrivilege	1004	taskkill.exe
Token: SeDebugPrivilege	4432	taskkill.exe
Token: SeDebugPrivilege	5960	taskkill.exe
Token: SeDebugPrivilege	4156	taskkill.exe
Token: SeDebugPrivilege	3704	taskkill.exe
Token: SeDebugPrivilege	4888	taskkill.exe
Token: SeDebugPrivilege	5604	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeDebugPrivilege	3432	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe
Token: SeDebugPrivilege	2920	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe
Token: SeDebugPrivilege	248	taskkill.exe
Token: SeDebugPrivilege	5004	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	2520	taskkill.exe
Token: SeDebugPrivilege	808	taskkill.exe
Token: SeDebugPrivilege	4488	taskkill.exe
Token: SeDebugPrivilege	4796	taskkill.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeDebugPrivilege	2976	taskkill.exe
Token: SeDebugPrivilege	856	taskkill.exe
Token: SeDebugPrivilege	3748	taskkill.exe
Token: SeDebugPrivilege	2868	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	4584	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	928	taskkill.exe
Token: SeDebugPrivilege	6084	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	4452	taskkill.exe
Token: SeDebugPrivilege	4780	taskkill.exe
Token: SeDebugPrivilege	4204	taskkill.exe
Token: SeDebugPrivilege	5204	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5204	sihost.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe
2488	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2912	java.exe
2704	javaw.exe
1668	StartMenuExperienceHost.exe
2356	SearchHost.exe
2488	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 5032	2912	java.exe	90
PID 5032 wrote to memory of 3756	5032	cmd.exe	92
PID 2912 wrote to memory of 3764	2912	java.exe	93
PID 3764 wrote to memory of 4556	3764	cmd.exe	95
PID 2912 wrote to memory of 2000	2912	java.exe	96
PID 2912 wrote to memory of 260	2912	java.exe	98
PID 2912 wrote to memory of 4764	2912	java.exe	100
PID 2912 wrote to memory of 1208	2912	java.exe	101
PID 2912 wrote to memory of 5828	2912	java.exe	102
PID 2912 wrote to memory of 2704	2912	java.exe	106
PID 2704 wrote to memory of 4568	2704	javaw.exe	107
PID 4568 wrote to memory of 3836	4568	cmd.exe	109
PID 2704 wrote to memory of 4740	2704	javaw.exe	110
PID 4740 wrote to memory of 540	4740	cmd.exe	112
PID 2704 wrote to memory of 1068	2704	javaw.exe	113
PID 2704 wrote to memory of 900	2704	javaw.exe	115
PID 2704 wrote to memory of 5744	2704	javaw.exe	116
PID 5744 wrote to memory of 5912	5744	cmd.exe	119
PID 2704 wrote to memory of 5680	2704	javaw.exe	121
PID 2704 wrote to memory of 4060	2704	javaw.exe	123
PID 2704 wrote to memory of 4112	2704	javaw.exe	125
PID 2704 wrote to memory of 4480	2704	javaw.exe	127
PID 2704 wrote to memory of 2872	2704	javaw.exe	129
PID 2704 wrote to memory of 5380	2704	javaw.exe	131
PID 2704 wrote to memory of 2664	2704	javaw.exe	133
PID 2704 wrote to memory of 1608	2704	javaw.exe	135
PID 2704 wrote to memory of 4808	2704	javaw.exe	137
PID 2704 wrote to memory of 4632	2704	javaw.exe	139
PID 2704 wrote to memory of 4692	2704	javaw.exe	141
PID 2704 wrote to memory of 3256	2704	javaw.exe	143
PID 2704 wrote to memory of 1612	2704	javaw.exe	145
PID 2704 wrote to memory of 2520	2704	javaw.exe	147
PID 2704 wrote to memory of 2592	2704	javaw.exe	149
PID 2704 wrote to memory of 4304	2704	javaw.exe	151
PID 2704 wrote to memory of 1208	2704	javaw.exe	153
PID 2704 wrote to memory of 5096	2704	javaw.exe	156
PID 2704 wrote to memory of 2800	2704	javaw.exe	158
PID 2704 wrote to memory of 4248	2704	javaw.exe	160
PID 2704 wrote to memory of 6060	2704	javaw.exe	162
PID 2704 wrote to memory of 4332	2704	javaw.exe	164
PID 2704 wrote to memory of 4700	2704	javaw.exe	166
PID 2704 wrote to memory of 3088	2704	javaw.exe	168
PID 2704 wrote to memory of 2960	2704	javaw.exe	170
PID 2704 wrote to memory of 1004	2704	javaw.exe	172
PID 2704 wrote to memory of 4432	2704	javaw.exe	174
PID 2704 wrote to memory of 5960	2704	javaw.exe	176
PID 2704 wrote to memory of 4156	2704	javaw.exe	178
PID 2704 wrote to memory of 3704	2704	javaw.exe	180
PID 2704 wrote to memory of 4888	2704	javaw.exe	182
PID 2704 wrote to memory of 5604	2704	javaw.exe	184
PID 2704 wrote to memory of 4916	2704	javaw.exe	186
PID 2704 wrote to memory of 4816	2704	javaw.exe	188
PID 2704 wrote to memory of 3432	2704	javaw.exe	190
PID 2704 wrote to memory of 1108	2704	javaw.exe	192
PID 2704 wrote to memory of 2920	2704	javaw.exe	194
PID 2704 wrote to memory of 5484	2704	javaw.exe	196
PID 2704 wrote to memory of 248	2704	javaw.exe	198
PID 2704 wrote to memory of 5004	2704	javaw.exe	200
PID 2704 wrote to memory of 1752	2704	javaw.exe	202
PID 2704 wrote to memory of 2520	2704	javaw.exe	204
PID 2704 wrote to memory of 808	2704	javaw.exe	206
PID 2704 wrote to memory of 4488	2704	javaw.exe	208
PID 2704 wrote to memory of 4796	2704	javaw.exe	210
PID 2704 wrote to memory of 3548	2704	javaw.exe	212

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1208	attrib.exe
5828	attrib.exe

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863.jar
1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1420243744994206167.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive1420243744994206167.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:3756
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3439820451923435092.vbs
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\cscript.exe
    cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3439820451923435092.vbs
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4556
- C:\Windows\SYSTEM32\xcopy.exe
  xcopy "C:\Program Files\Java\jre-1.8" "C:\Users\Admin\AppData\Roaming\Oracle\" /e
  2⤵
  PID:2000
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:260
- C:\Windows\SYSTEM32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UHicTHQJfhH /t REG_EXPAND_SZ /d "\"C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe\" -jar \"C:\Users\Admin\jyzlFFZwNRD\gOJaxIPLBpP.fzXYWv\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4764
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\jyzlFFZwNRD\*.*"
  2⤵
  - Views/modifies file attributes
  PID:1208
- C:\Windows\SYSTEM32\attrib.exe
  attrib +h "C:\Users\Admin\jyzlFFZwNRD"
  2⤵
  - Views/modifies file attributes
  PID:5828
- C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
  C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe -jar C:\Users\Admin\jyzlFFZwNRD\gOJaxIPLBpP.fzXYWv
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8475391237559440484.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive8475391237559440484.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3836
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3121204224761184687.vbs
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\system32\cscript.exe
      cscript.exe C:\Users\Admin\AppData\Local\Temp\Retrive3121204224761184687.vbs
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:1068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ProcessHacker.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:900
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c regedit.exe /s C:\Users\Admin\AppData\Local\Temp\AJfYmlClDC8476013011158021633.reg
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\AJfYmlClDC8476013011158021633.reg
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Runs .reg file with regedit
      PID:5912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MSASCui.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5680
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MsMpEng.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MpUXSrv.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MpCmdRun.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM NisSrv.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ConfigSecurityPolicy.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM procexp.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM wireshark.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM tshark.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM text2pcap.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM rawshark.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mergecap.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM editcap.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM dumpcap.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM capinfos.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbam.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbamscheduler.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1208
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM mbamservice.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareService.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM WebCompanion.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AdAwareDesktop.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Main.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Svc.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Up.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3SP.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Proxy.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM V3Medic.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BgScan.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuard.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuardBhvScanner.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuarScanner.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM LittleHook.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BullGuardUpdate.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM clamscan.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ClamTray.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ClamWin.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cis.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM CisTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cmdagent.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM cavwp.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM dragon_updater.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MWAGENT.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MWASER.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM CONSCTLX.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM avpmapp.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM econceal.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM escanmon.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM escanpro.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:856
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM TRAYSSER.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3748
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM TRAYICOS.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM econser.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM VIEWTCP.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSHDLL64.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fsgk32.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fshoster32.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSMA32.EXE /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fsorsp.exe /T /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fssm32.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FSM32.EXE /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM trigger.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FProtTray.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FPWin.exe /T /F
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FPAVServer.exe /T /F
    3⤵
    PID:3528
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVK.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GdBgInx64.exe /T /F
    3⤵
    PID:2068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKProxy.exe /T /F
    3⤵
    PID:5424
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDScan.exe /T /F
    3⤵
    PID:1156
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKWCtlx64.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5964
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKService.exe /T /F
    3⤵
    PID:5944
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AVKTray.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3756
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDKBFltExe32.exe /T /F
    3⤵
    PID:5828
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM GDSC.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM virusutilities.exe /T /F
    3⤵
    PID:2232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM guardxservice.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3492
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM guardxkickoff_x64.exe /T /F
    3⤵
    PID:1304
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM iptray.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2288
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM freshclam.exe /T /F
    3⤵
    PID:3548
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM freshclamwrap.exe /T /F
    3⤵
    PID:4148
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7RTScan.exe /T /F
    3⤵
    PID:2852
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7FWSrvc.exe /T /F
    3⤵
    PID:3636
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7PSSrvc.exe /T /F
    3⤵
    PID:6048
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7EmlPxy.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:4092
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSecurity.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4080
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7AVScan.exe /T /F
    3⤵
    PID:3088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7CrvSvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4448
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7SysMon.Exe /T /F
    3⤵
    PID:2604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMain.exe /T /F
    3⤵
    PID:4596
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMngr.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2088
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nanosvc.exe /T /F
    3⤵
    PID:1512
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nanoav.exe /T /F
    3⤵
    PID:5380
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nnf.exe /T /F
    3⤵
    PID:2152
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvcsvc.exe /T /F
    3⤵
    PID:3296
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nbrowser.exe /T /F
    3⤵
    PID:1516
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nseupdatesvc.exe /T /F
    3⤵
    PID:3436
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nfservice.exe /T /F
    3⤵
    PID:4920
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nwscmon.exe /T /F
    3⤵
    PID:1444
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM njeeves2.exe /T /F
    3⤵
    PID:3472
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvcod.exe /T /F
    3⤵
    PID:4292
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nvoy.exe /T /F
    3⤵
    PID:2260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM zlhh.exe /T /F
    3⤵
    PID:4556
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Zlh.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4548
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM nprosec.exe /T /F
    3⤵
    PID:3024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Zanda.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2916
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM NS.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1548
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM acs.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5220
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM op_mon.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4856
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSANHost.exe /T /F
    3⤵
    PID:4700
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSUAMain.exe /T /F
    3⤵
    PID:2692
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PSUAService.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2712
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM AgentSvc.exe /T /F
    3⤵
    PID:1404
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BDSSVC.EXE /T /F
    3⤵
    PID:4320
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM EMLPROXY.EXE /T /F
    3⤵
    - Kills process with taskkill
    PID:4060
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM OPSSVC.EXE /T /F
    3⤵
    PID:2568
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ONLINENT.EXE /T /F
    3⤵
    PID:928
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM QUHLPSVC.EXE /T /F
    3⤵
    PID:1200
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SAPISSVC.EXE /T /F
    3⤵
    PID:4448
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SCANNER.EXE /T /F
    3⤵
    PID:4572
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SCANWSCS.EXE /T /F
    3⤵
    PID:2984
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM scproxysrv.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3440
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM ScSecSvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4596
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SUPERAntiSpyware.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2756
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SASCore64.exe /T /F
    3⤵
    PID:3056
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SSUpdate64.exe /T /F
    3⤵
    PID:5228
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SUPERDelete.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SASTask.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4576
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7RTScan.exe /T /F
    3⤵
    PID:2400
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7FWSrvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3432
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7PSSrvc.exe /T /F
    3⤵
    PID:3876
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7EmlPxy.EXE /T /F
    3⤵
    PID:3172
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSecurity.exe /T /F
    3⤵
    PID:5768
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7AVScan.exe /T /F
    3⤵
    PID:1664
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7CrvSvc.exe /T /F
    3⤵
    PID:5428
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7SysMon.Exe /T /F
    3⤵
    PID:1264
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMain.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2504
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM K7TSMngr.exe /T /F
    3⤵
    PID:1260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM uiWinMgr.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4488
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM uiWatchDog.exe /T /F
    3⤵
    PID:3268
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM uiSeAgnt.exe /T /F
    3⤵
    PID:4872
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PtWatchDog.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3652
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PtSvcHost.exe /T /F
    3⤵
    PID:2388
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM PtSessionAgent.exe /T /F
    3⤵
    PID:2708
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM coreFrameworkHost.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4668
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM coreServiceShell.exe /T /F
    3⤵
    PID:5220
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM uiUpdateTray.exe /T /F
    3⤵
    PID:5912
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM VIPREUI.exe /T /F
    3⤵
    PID:5812
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SBAMSvc.exe /T /F
    3⤵
    PID:1004
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SBAMTray.exe /T /F
    3⤵
    PID:2272
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SBPIMSvc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1416
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM bavhm.exe /T /F
    3⤵
    PID:896
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BavSvc.exe /T /F
    3⤵
    PID:4864
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BavTray.exe /T /F
    3⤵
    PID:5384
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM Bav.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:6044
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BavWebClient.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1188
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM BavUpdater.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4760
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MCShieldCCC.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1288
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MCShieldRTM.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:552
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MCShieldDS.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2308
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM MCS-Uninstall.exe /T /F
    3⤵
    PID:4468
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SDScan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4552
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SDFSSvc.exe /T /F
    3⤵
    PID:3528
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SDWelcome.exe /T /F
    3⤵
    PID:2068
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM SDTray.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4696
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM UnThreat.exe /T /F
    3⤵
    PID:5564
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM utsvc.exe /T /F
    3⤵
    PID:5880
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FortiClient.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1612
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fcappdb.exe /T /F
    3⤵
    PID:4560
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FCDBlog.exe /T /F
    3⤵
    PID:5768
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FCHelper64.exe /T /F
    3⤵
    PID:260
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM fmon.exe /T /F
    3⤵
    PID:1484
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FortiESNAC.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4788
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FortiProxy.exe /T /F
    3⤵
    PID:1408
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FortiSSLVPNdaemon.exe /T /F
    3⤵
    PID:5496
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FortiTray.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4024
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FortiFW.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:2976
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FortiClient_Diagnostic_Tool.exe /T /F
    3⤵
    PID:1348
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM av_task.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3520
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM CertReg.exe /T /F
    3⤵
    PID:1268
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FilMsg.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:1628
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM FilUp.exe /T /F
    3⤵
    PID:4952
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM filwscc.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:4236
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM filwscc.exe /T /F
    3⤵
    PID:1084
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM psview.exe /T /F
    3⤵
    PID:5888
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM quamgr.exe /T /F
    3⤵
    PID:5972
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM quamgr.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:3316
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM schmgr.exe /T /F
    3⤵
    PID:4592
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM schmgr.exe /T /F
    3⤵
    PID:3704
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM twsscan.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:896
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM twssrv.exe /T /F
    3⤵
    - Kills process with taskkill
    PID:5604
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /IM UserReg.exe /T /F
    3⤵
    PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:5204
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2488

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2356

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

AJfYmlClDC8476013011158021633.reg

Path C:\Users\Admin\AppData\Local\Temp\AJfYmlClDC8476013011158021633.reg
Size 25KB
SHA256 ac7364ba0312ec6c3aca90ab04004597eef5a3d8b62c6f4bb83314df035a13c8
MD5 0e4135dde66b12ca5cea69b76fb7d550
SHA1 cfe1b661b423958a1a37c456bbe274fb317c03ee
SHA512 059ad421c1528aaa3dff7d4401630ae2674a4a26d615aeb1df2cb376cda7334aeb1ea747c12a4402a400a28923270c3f6c2968cae21367c240549f5af921e2b4
SSDEEP 96:PztmtLitmtJCtTt6tVtatNtgtitCtztHtxtMt8thtVRtTtstHtT6tRtmtJtvtUt/:PCnuR0hTmEgGpF
TLSH
T1CFC209508A35433492F274948646AC523F7E533E7647ABA96488D01DB3A1B9BC29F3CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Retrive1420243744994206167.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive1420243744994206167.vbs
Size 276B
SHA256 9da575dd2d5b7c1e9bab8b51a16cde457b3371c6dcdb0537356cf1497fa868f6
MD5 3bdfd33017806b85949b6faa7d4b98e4
SHA1 f92844fee69ef98db6e68931adfaa9a0a0f8ce66
SHA512 ae5e5686ae71edef53e71cd842cb6799e4383b9c238a5c361b81647efa128d2fedf3bf464997771b5b0c47a058fecae7829aeedcd098c80a11008581e5781429
TLSH
T12ED02B0094E3C35000BE970290E9662EF9A2020D32015B487D4450F3222E0BEEAB15B5
MD5 SHA1 SHA512 TLSH

Submit Download

Retrive3439820451923435092.vbs

Path C:\Users\Admin\AppData\Local\Temp\Retrive3439820451923435092.vbs
Size 281B
SHA256 45bfe34aa3ef932f75101246eb53d032f5e7cf6d1f5b4e495334955a255f32e7
MD5 a32c109297ed1ca155598cd295c26611
SHA1 dc4a1fdbaad15ddd6fe22d3907c6b03727b71510
SHA512 70372552dc86fe02ece9fe3b7721463f80be07a34126b2c75b41e30078cda9e90744c7d644df623f63d4fb985482e345b3351c4d3da873162152c67fc6ecc887
TLSH
T1C0D02B00D4E7C39000BED702D1E5926EB9E2010D320157487D8490FB12AA07EE5711B5
MD5 SHA1 SHA512 TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_332724ed-3c1a-4b0f-bd9b-045e18507ba6

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-552508041-2681165170-3229858294-1000\83aa4cc77f591dfc2374580bbd95f6ba_332724ed-3c1a-4b0f-bd9b-045e18507ba6
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

awt.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\awt.dll
Size 1.3MB
SHA256 6d1c82cad959b7e4636d8fced4368f0f2c8da4ef609667396e8772ad8d63f736
MD5 39a3de251306cbca47cf2fb10089ae9f
SHA1 cc3f3d1bc3ad172c9646961b18fe1d7bf98b59a5
SHA512 351a02453659d04a2943abc1da2b9541f97982ed3f94d288679dfd8d962bfb4b0dcdef9b06d329bdad64e032b0372733ff7d1577c49952accf86b971aed86f7e
SSDEEP 24576:or19iF8DpwAZGFCFcbtv5nHSaELVPwtDi6MDO6aBN1VWgerlE6:6XiF8tpGFJHwVoY6MDO6aBN1cLf
TLSH
T1BB658D07F3944095D66FA4B4C29B521FE7B2B419030097EB32B19B6EBF67BE06239345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fontmanager.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\fontmanager.dll
Size 300KB
SHA256 889f837c011beea74573837a9c0316f375512b08a863bf1ee08032b72dae2bff
MD5 80f541f9da85e791626275a140d7f2d7
SHA1 66eb0fb72d458a3c1eec721245b645fc43854ce8
SHA512 bc212eff3fe6f04b21f1e28d042bc5b192e4016578b9f7714bd996eeb5fee33b743248fbe5ef03ae5abfbbf10b263af77e7dc463e71d2847113233efebb43f10
SSDEEP 6144:aegAcvjh+en79Eni6NTfgU+5FzHQUgi452LFGMReiDB+zjRnaaJ:3gAcV+eBEnisff+5FzHQUgiC2RGSoBaG
TLSH
T1C7644A52B28B02A1FD6F807845B74A1EE77678584302D7CB53A05BC93F7BBD42AF9240
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\java.dll
Size 162KB
SHA256 179df744661b659d50fd6943834d81476287c2075448d2dc783fb32c69a00e54
MD5 4e6dfd5867f4cea96dad1d59a0ca43fe
SHA1 6a08abc0b5a2cab00eb6d7543c661aa6620890a1
SHA512 2565197c75eca66600a530aa6b033d4985fcb05edf73e096ebba37f06016e6ae5c4fc516a182bf674ff18e3f3b031353c9ff187a6b8804058b5d2b47c914e60b
SSDEEP 3072:dgpGH1/rHpcDJ0oL9JLVZcRysrS7DgWw2xM:Wpg0TZHQh
TLSH
T170F32947A3524092F457B6B8B12A000BF376B465032C92EB43E58BAE5FAF7317D47794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\javaw.exe
Size 285KB
SHA256 a64ead73c06470bc5c84cfc231b0723d70d29fec7d385a268be2c590dc5eb1ef
MD5 7fb44c5bca4226d8aab7398e836807a2
SHA1 47128e4f8afabfde5037ed0fcaba8752c528ff52
SHA512 f0bd093f054c99bcc50df4005d0190bd7e3dcefea7008ae4c9b67a29e832e02ae9ff39fa75bc1352c127aeb13afdea9bfdcc238ac826ef17f288d6fbd2ec8cab
SSDEEP 6144:PAHdwS/WYoTOLHIsPPzAdnz0YutYPDvhD:PCd9/WYoaLHF3z0z04PDvhD
TLSH
T142548EA5B3901CF8EC67813EC9558906D6B27C5A0770C65F03A836675F333A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\management.dll
Size 44KB
SHA256 5e7fbfceaea80ff9d3691f56eba7b68a4f13f0317e7961cc0e23672952b34e1d
MD5 388b808b78870de046976fbb600662eb
SHA1 34e4ee12ce8c0b7fd0258202162c7c6f7575c9a9
SHA512 9024e63c17d903314e5f3d4fdf99c40f23d04ca0471951589e2ab679709bcc3376bfb847961cd54b949e4a684eaf13114ad338f4e3b1e6be11af10c0687da91c
SSDEEP 768:igQ8L4Pi+2LPe/0wZsW8u2FOSz+qzpIqJYifcPxWETDh:HGwC0wZ58p3z+qNIqJ7UPx7
TLSH
T121133D22676D5086F4DFB175B4910532DAB1B4D22B80938F0370C6295FBBFE27639275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\msvcp140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
TLSH
T1FCC40927B74D02A0E195A3B861C34305D7F1BC4A8312A3C752FAD66E2F6B7D5673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\net.dll
Size 104KB
SHA256 833cdbd7b221dda58ba728ee9a41cac1d6819d19bfc7336a4b86cc69a5af3695
MD5 6c720917e5c8ce1202a4141e8c8cfaf7
SHA1 1175d918134983d1d64a42047f4ff814054123de
SHA512 217f824b389547993556c26069d58eb956e87029b5c58556c2d308e48a0db2a02a057b3147fcf6ac7606f2b97ada33e2372112e93944f645137d81cc0dd32a9d
SSDEEP 1536:2vpp3y2kIlAYVZ+qbzKWrTcJuV618k89DmucOiG/OJY9GzNAiKyy0CLLLdx7PPxD:pYSqbzKWrTcJuGbEDmYGeifLCDdxLxD
TLSH
T1FCA35A05736824C1FC3BD2BC8586461BD7B3B4B06260939F13A6C65A6FDB7B13E19B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\nio.dll
Size 66KB
SHA256 686021b000cd6d76b97c6f924c528293bc55dfb4ce936cfe70959eecd1665c90
MD5 d8a6b5e5a33cb71b61964be369526704
SHA1 7788adf9163fb2ac2c85c43630c0998b0f13360a
SHA512 d15e5832d025a8fb17dd48b8c6d8246b93d54543ba52d40a9f97aff257847f7e05971ae927a77e12ab1625dc514a29115ce5fe9ddad18fe5fc4b0ddc2f8ca6d1
SSDEEP 768:QSwbGTKTjBFs3zdaON+ClYKaFwoqgzizndNXur2Z3/oHbg6wuZWm3w3hUjhgYi5x:olONFYKAQn7Xur20bCCJ3Khyhg75PxQ+
TLSH
T154631AB253A4489BE42AB53C429A075BF433FC508510A39F532987169B6F3B33B7D792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\server\jvm.dll
Size 8.5MB
SHA256 6707043f0b609a0b3677cd11f6526d8ecfcbeab079a394019d648c9039e7da21
MD5 dceeb4fb6af9bb2ea7a2eed1d921afb5
SHA1 af1463a499f7d6eed5efcb9c9515e82335e9c1b6
SHA512 e4688d2264dda88e90beeb394adc48064012ed458ab9015ecef744a86ab76b4f65845f77a3d02b131aa5c342e6a572f79f471b5dc8df178b2d7483c04b1f4763
SSDEEP 98304:OhNdNu6fLpeSRNeOhWnaC5Qu5e9kmhRVfvLP0KsH1OIueGeM1Q:OhNdNu6fLpDRwOhoaCyucC0RVfjPiHuC
TLSH
T11D966C5A927050D8DB2AC2788B17DE47E7F2F4A40770ABCB11B8434E5F17BE1297E216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunec.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\sunec.dll
Size 142KB
SHA256 86106645d9e3801911808d6343a7fead7b6e9d8b740bad63a4cd9851ff599283
MD5 2632b6d90868ff1ece67f76b86a23d79
SHA1 90ddedde02a4cc37ae361caabc36a6a686c24bd1
SHA512 61e0581c3dde45db74383b93e56396c65435714e746fe4f000c53465e8e6750bd787b5895a987bbdbe4badb5ad3570394c82476c2b4d65099f0b923002153b18
SSDEEP 3072:2zs5pH2Lmngo9QVKTIVbheI14/QwIwS6ycf+lxhC:Cs5pWLmngo9HTMhp14Hpyc7
TLSH
T1C5E36C4732E08297C9638A31C953F55AEFB0B82576E0C37B13574A45EF23395AE2B325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\vcruntime140.dll
Size 95KB
SHA256 475ab98b7722e965bd38c8fa6ed23502309582ccf294ff1061cb290c7988f0d1
MD5 7415c1cc63a0c46983e2a32581daefee
SHA1 5f8534d79c84ac45ad09b5a702c8c5c288eae240
SHA512 3d4b24061f72c0e957c7b04a0c4098c94c8f1afb4a7e159850b9939c7210d73398be6f27b5ab85073b4e8c999816e7804fef0f6115c39cd061f4aaeb4dcda8cf
SSDEEP 1536:M4h79voUUUCaisMiQFJp0hYSKnMNFYNa86ecb63UNU:M8WvicJpwYVMNFYNB6ecb63U6
TLSH
T174936C4677A542B7D06AD278C2E35A06F770B844877063CF03B64AA94F23BE19E3E355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\vcruntime140_1.dll
Size 36KB
SHA256 0579d460ea1f7e8a815fa55a8821a5ff489c8097f051765e9beaf25d8d0f27d6
MD5 fcda37abd3d9e9d8170cd1cd15bf9d3f
SHA1 b23ff3e9aa2287b9c1249a008c0ae06dc8b6fdf2
SHA512 de8be61499aaa1504dde8c19666844550c2ea7ef774ecbe26900834b252887da31d4cf4fb51338b16b6a4416de733e519ebf8c375eb03eb425232a6349da2257
SSDEEP 384:1JfphjEpTUUtKldl3864/vc5fqiu85mIlRWNQQbz6Yf7ZJA/U3qJrWr2KW8KLHR9:Phh4pTUUtmUwqiu8oSRjez6S7fqHwAb
TLSH
T16EF24B9467B88446D06B86B0C4D3AE57BE3CF9655750938F0BA4C29D1F23BD0AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verify.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\verify.dll
Size 55KB
SHA256 9c99e6591c73eda0dfd6bb9a55d0a175cf5bdb583115477cedc627fd793c3deb
MD5 82bb3a2292372acbf8bb25e30a3e169c
SHA1 c09c134561213cd67c670f60a2c52cf947e51a74
SHA512 db4802fe0e3a6dc1678765af559e9c1f6e8639dd5c7c8f18f08296b1b4d15cfe748e391459253a3dde0ca2bda74c6772af262e5b194c78c6bdefbcc2c5377db7
SSDEEP 768:gGq5ZtjA9EC+mzTJaJSMR26WPI/hY5iX2N9mWKYilefjPxWEta:gGsTSP+mG726iI/hqPN9mWK7wjPxG
TLSH
T1AE436B6792A00875E087C538C5639EDBEBB1FAD51A4083CB4360C6CDBF53B51EA2477A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Users\Admin\AppData\Roaming\Oracle\bin\zip.dll
Size 87KB
SHA256 27cf17beab60d7f9a62aac7622eefa06eee78796db585f9ae5d3a5b5022d56a9
MD5 0d56a7ff632826362768b3edd5e5174f
SHA1 8b96856f8fe3175039d1a7cf3ac0910467844a08
SHA512 b4fe51874b9ba7a2325ae3c0b96f32065f7cee7c846a9028495070f1f91cedd9445cb91248acd1ec134a72b2c07e49afcaef01b58af1dfb0ff417033c2d0e595
SSDEEP 1536:d4oESIZDpOoUQ4Ps5OwVOIOQIO6nqejL8j672PxV/:d4o5IZDZUXwV8G6nqejLY6WxV/
TLSH
T1A5939D918A605561DAB799B0C9F68A2ED376B02013C497CB534CC7962F477A13F8C3EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ID.txt

Path C:\Users\Admin\jyzlFFZwNRD\ID.txt
Size 47B
SHA256 f9ce0adc9946f50df6d37395ebb2df8bd62f4abb2756ab687d8c6f8536d6e6cb
MD5 22bc79f3eef33fee49858290f2a62a63
SHA1 44b921ce32269e0d38045c837dac4c02be28401d
SHA512 cf0d97b09b2dea75fb6669f600735054a777849c76ad292b1a51bfad4b85a37ceb670743b6033222ff7fe68c74c38c5ceeb2f287fd7758bd4a0aa2f6b2500e82
MD5 SHA1 SHA512

Submit Download

gOJaxIPLBpP.fzXYWv

Path C:\Users\Admin\jyzlFFZwNRD\gOJaxIPLBpP.fzXYWv
Size 495KB
SHA256 484a712197407f3294b64ba3285a0b715a526dd6e58fc7b584a9f3dd5f8d4863
MD5 387f5cedb97aff48c3905a0b5a635604
SHA1 7b8c94ccc84d5f48119af79ff5e47b4fa8d3738c
SHA512 899d8848351d5b7b918a7ed38a610dceb82d8928c1f26d955aa206f0fe9ede1161e93e845adb67372d953ea972cbefc3d8d53a624ba909b6ea5a9e29d861988a
SSDEEP 12288:Ipeb8cFBDLwPHEPrqxXVzqnQOzaO9yHhH7jtvEAv2ODv71Dzbk:eqBQwSYaOIHhHd52sv79k
TLSH
T130B423B9A90C9337E27F2338580178B29CBDC12DE40BD8A5D0A5D336596CEE91F87E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-554-0x000001F5801E0000-0x000001F5802E0000-memory.dmp

Download

memory/2356-564-0x000001F581A10000-0x000001F581A30000-memory.dmp

Download

memory/2356-580-0x000001F581D60000-0x000001F581D80000-memory.dmp

Download

memory/2356-566-0x000001F581E60000-0x000001F581F60000-memory.dmp

Download

memory/2356-600-0x000001F594280000-0x000001F5942A0000-memory.dmp

Download

memory/2488-729-0x000000000F120000-0x000000000F99B000-memory.dmp

Download

memory/2704-320-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-217-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-530-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-376-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-353-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-329-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-533-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-302-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-299-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-297-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-224-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-531-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-213-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-196-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-194-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-193-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-188-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-728-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-774-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-172-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-791-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2704-141-0x000002FB238C0000-0x000002FB238C1000-memory.dmp

Download

memory/2912-40-0x00000275EFA50000-0x00000275EFA60000-memory.dmp

Download

memory/2912-37-0x00000275EFA40000-0x00000275EFA50000-memory.dmp

Download

memory/2912-35-0x00000275EFAD0000-0x00000275EFAE0000-memory.dmp

Download

memory/2912-122-0x00000275EFBA0000-0x00000275EFBB0000-memory.dmp

Download

memory/2912-121-0x00000275EFB90000-0x00000275EFBA0000-memory.dmp

Download

memory/2912-34-0x00000275EFAC0000-0x00000275EFAD0000-memory.dmp

Download

memory/2912-33-0x00000275EF7D0000-0x00000275EFA40000-memory.dmp

Download

memory/2912-2-0x00000275EF7D0000-0x00000275EFA40000-memory.dmp

Download

memory/2912-119-0x00000275EFB70000-0x00000275EFB80000-memory.dmp

Download

memory/2912-118-0x00000275EFB60000-0x00000275EFB70000-memory.dmp

Download

memory/2912-117-0x00000275EFB50000-0x00000275EFB60000-memory.dmp

Download

memory/2912-116-0x00000275EFB40000-0x00000275EFB50000-memory.dmp

Download

memory/2912-115-0x00000275EFB10000-0x00000275EFB20000-memory.dmp

Download

memory/2912-114-0x00000275EFAF0000-0x00000275EFB00000-memory.dmp

Download

memory/2912-113-0x00000275EFAE0000-0x00000275EFAF0000-memory.dmp

Download

memory/2912-112-0x00000275EF7D0000-0x00000275EFA40000-memory.dmp

Download

memory/2912-111-0x00000275EFA90000-0x00000275EFAA0000-memory.dmp

Download

memory/2912-110-0x00000275EFA70000-0x00000275EFA80000-memory.dmp

Download

memory/2912-109-0x00000275EFA80000-0x00000275EFA90000-memory.dmp

Download

memory/2912-108-0x00000275EFA60000-0x00000275EFA70000-memory.dmp

Download

memory/2912-107-0x00000275EFA50000-0x00000275EFA60000-memory.dmp

Download

memory/2912-106-0x00000275EFA40000-0x00000275EFA50000-memory.dmp

Download

memory/2912-105-0x00000275EFAD0000-0x00000275EFAE0000-memory.dmp

Download

memory/2912-104-0x00000275EF730000-0x00000275EF731000-memory.dmp

Download

memory/2912-31-0x00000275EFAB0000-0x00000275EFAC0000-memory.dmp

Download

memory/2912-38-0x00000275EFAE0000-0x00000275EFAF0000-memory.dmp

Download

memory/2912-28-0x00000275EFAA0000-0x00000275EFAB0000-memory.dmp

Download

memory/2912-26-0x00000275EFA90000-0x00000275EFAA0000-memory.dmp

Download

memory/2912-24-0x00000275EFA80000-0x00000275EFA90000-memory.dmp

Download

memory/2912-23-0x00000275EFA70000-0x00000275EFA80000-memory.dmp

Download

memory/2912-20-0x00000275EFA60000-0x00000275EFA70000-memory.dmp

Download

memory/2912-120-0x00000275EFB80000-0x00000275EFB90000-memory.dmp

Download

memory/2912-41-0x00000275EFAF0000-0x00000275EFB00000-memory.dmp

Download

memory/2912-18-0x00000275EFA50000-0x00000275EFA60000-memory.dmp

Download

memory/2912-94-0x00000275EFB30000-0x00000275EFB40000-memory.dmp

Download

memory/2912-16-0x00000275EFA40000-0x00000275EFA50000-memory.dmp

Download

memory/2912-89-0x00000275EFB20000-0x00000275EFB30000-memory.dmp

Download

memory/2912-88-0x00000275EFB10000-0x00000275EFB20000-memory.dmp

Download

memory/2912-54-0x00000275EFA80000-0x00000275EFA90000-memory.dmp

Download

memory/2912-48-0x00000275EFB00000-0x00000275EFB10000-memory.dmp

Download

memory/2912-82-0x00000275EFBA0000-0x00000275EFBB0000-memory.dmp

Download

memory/2912-81-0x00000275EFB00000-0x00000275EFB10000-memory.dmp

Download

memory/2912-68-0x00000275EF730000-0x00000275EF731000-memory.dmp

Download

memory/2912-71-0x00000275EFAD0000-0x00000275EFAE0000-memory.dmp

Download

memory/2912-78-0x00000275EFAF0000-0x00000275EFB00000-memory.dmp

Download

memory/2912-79-0x00000275EFB90000-0x00000275EFBA0000-memory.dmp

Download

memory/2912-72-0x00000275EFB70000-0x00000275EFB80000-memory.dmp

Download

memory/2912-73-0x00000275EFB80000-0x00000275EFB90000-memory.dmp

Download

memory/2912-74-0x00000275EFAE0000-0x00000275EFAF0000-memory.dmp

Download

memory/2912-67-0x00000275EFB60000-0x00000275EFB70000-memory.dmp

Download

memory/2912-66-0x00000275EFAC0000-0x00000275EFAD0000-memory.dmp

Download

memory/2912-64-0x00000275EFB50000-0x00000275EFB60000-memory.dmp

Download

memory/2912-14-0x00000275EF730000-0x00000275EF731000-memory.dmp

Download

memory/2912-63-0x00000275EFAB0000-0x00000275EFAC0000-memory.dmp

Download

memory/2912-60-0x00000275EFAA0000-0x00000275EFAB0000-memory.dmp

Download

memory/2912-61-0x00000275EFB40000-0x00000275EFB50000-memory.dmp

Download

memory/2912-57-0x00000275EFB30000-0x00000275EFB40000-memory.dmp

Download

memory/2912-56-0x00000275EFA90000-0x00000275EFAA0000-memory.dmp

Download

memory/2912-46-0x00000275EFA60000-0x00000275EFA70000-memory.dmp

Download

memory/2912-47-0x00000275EFA70000-0x00000275EFA80000-memory.dmp

Download

memory/2912-52-0x00000275EFB10000-0x00000275EFB20000-memory.dmp

Download

memory/2912-53-0x00000275EFB20000-0x00000275EFB30000-memory.dmp

Download