Overview
overview
10Static
static
81.bin/1.bin.exe
windows7_x64
101.bin/1.bin.exe
windows10_x64
102019-09-02...10.exe
windows7_x64
102019-09-02...10.exe
windows10_x64
1031.exe
windows7_x64
1031.exe
windows10_x64
103DMark 11 ...on.exe
windows7_x64
13DMark 11 ...on.exe
windows10_x64
15da0116af4...18.exe
windows7_x64
85da0116af4...18.exe
windows10_x64
8Archive.zi...3e.exe
windows7_x64
8Archive.zi...3e.exe
windows10_x64
8CVE-2018-1...oC.swf
windows7_x64
3CVE-2018-1...oC.swf
windows10_x64
3CVWSHSetup...1].exe
windows7_x64
3CVWSHSetup...1].exe
windows10_x64
3DiskIntern...en.exe
windows7_x64
1DiskIntern...en.exe
windows10_x64
1ForceOp 2....ce.exe
windows7_x64
10ForceOp 2....ce.exe
windows10_x64
10HYDRA.exe
windows7_x64
10HYDRA.exe
windows10_x64
10Keygen.exe
windows7_x64
10Keygen.exe
windows10_x64
10Lonelyscre...ox.exe
windows7_x64
1Lonelyscre...ox.exe
windows10_x64
1LtHv0O2KZDK4M637.exe
windows7_x64
10LtHv0O2KZDK4M637.exe
windows10_x64
10Magic_File...ja.exe
windows7_x64
1Magic_File...ja.exe
windows10_x64
1OnlineInstaller.exe
windows7_x64
8OnlineInstaller.exe
windows10_x64
8Analysis
-
max time kernel
154s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-11-2020 16:58
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
1.bin/1.bin.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
2019-09-02_22-41-10.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
31.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
CVE-2018-15982_PoC.swf
Resource
win7v20201028
Behavioral task
behavioral14
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral15
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
HYDRA.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
HYDRA.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
Keygen.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
Keygen.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win7v20201028
Behavioral task
behavioral26
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
LtHv0O2KZDK4M637.exe
Resource
win7v20201028
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win7v20201028
Behavioral task
behavioral30
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
OnlineInstaller.exe
Resource
win7v20201028
Behavioral task
behavioral32
Sample
OnlineInstaller.exe
Resource
win10v20201028
General
-
Target
HYDRA.exe
Malware Config
Extracted
smokeloader
2017
http://92.53.105.14/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE ⋅ 10 IoCs
Processes:
yaya.exeva.exeufx.exesant.exepower.exestarter.exeusc.exeservices.exeservices.exefoxcon.exepid process 2028 yaya.exe 1212 va.exe 1160 ufx.exe 1960 sant.exe 1292 power.exe 1764 starter.exe 1116 usc.exe 940 services.exe 788 services.exe 1140 foxcon.exe -
Drops startup file ⋅ 1 IoCs
Processes:
va.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HDAudo.vbs va.exe -
Loads dropped DLL ⋅ 12 IoCs
Processes:
HYDRA.exeyaya.exeufx.exepid process 1028 HYDRA.exe 1028 HYDRA.exe 1028 HYDRA.exe 1028 HYDRA.exe 1028 HYDRA.exe 1028 HYDRA.exe 1028 HYDRA.exe 1028 HYDRA.exe 2028 yaya.exe 1160 ufx.exe 1160 ufx.exe 1160 ufx.exe -
Adds Run key to start application ⋅ 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppDataLow = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\gtbidieh\\gtgbhwif.exe" explorer.exe -
Maps connected drives based on registry ⋅ 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
sant.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum sant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 sant.exe -
Drops file in System32 directory ⋅ 2 IoCs
Processes:
foxcon.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT foxcon.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT foxcon.exe -
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS ⋅ 21 IoCs
Processes:
services.exefoxcon.exeservices.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows services.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\FoxCond\{1945BBS40-8571-3DA1-BB29-HYDRA7A11A1E} = "C:\\Windows\\Temp\\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\\services.exe" services.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\GDIPlus foxcon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System services.exe Key created \REGISTRY\USER\.DEFAULT\Software services.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\FoxCond\{1945BBS40-8571-3DA1-BB29-HYDRA7A11A1E} = "C:\\Windows\\Temp\\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\\services.exe" services.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\GDIPlus\FontCachePath = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local" foxcon.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" services.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion services.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies services.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System services.exe Key created \REGISTRY\USER\.DEFAULT\Software\FoxCond services.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" services.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Foxcon Service Control = "C:\\Windows\\TEMP\\foxcon.exe" foxcon.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft services.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" services.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" services.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" services.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ services.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run foxcon.exe -
Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
Processes:
sant.exepid process 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe 1960 sant.exe -
Suspicious behavior: MapViewOfSection ⋅ 2 IoCs
Processes:
sant.exepid process 1960 sant.exe 1960 sant.exe -
Suspicious use of AdjustPrivilegeToken ⋅ 6 IoCs
Processes:
usc.exestarter.exeservices.exeservices.exefoxcon.exepowershell.exedescription pid process Token: SeDebugPrivilege 1116 usc.exe Token: SeDebugPrivilege 1764 starter.exe Token: SeDebugPrivilege 940 services.exe Token: SeDebugPrivilege 788 services.exe Token: SeDebugPrivilege 1140 foxcon.exe Token: SeDebugPrivilege 936 powershell.exe -
Suspicious use of WriteProcessMemory ⋅ 61 IoCs
Processes:
HYDRA.exeyaya.exeufx.exeusc.exesant.exestarter.execsc.execmd.exeservices.exepower.exedescription pid process target process PID 1028 wrote to memory of 2028 1028 HYDRA.exe yaya.exe PID 1028 wrote to memory of 2028 1028 HYDRA.exe yaya.exe PID 1028 wrote to memory of 2028 1028 HYDRA.exe yaya.exe PID 1028 wrote to memory of 2028 1028 HYDRA.exe yaya.exe PID 1028 wrote to memory of 1212 1028 HYDRA.exe va.exe PID 1028 wrote to memory of 1212 1028 HYDRA.exe va.exe PID 1028 wrote to memory of 1212 1028 HYDRA.exe va.exe PID 1028 wrote to memory of 1212 1028 HYDRA.exe va.exe PID 1028 wrote to memory of 1160 1028 HYDRA.exe ufx.exe PID 1028 wrote to memory of 1160 1028 HYDRA.exe ufx.exe PID 1028 wrote to memory of 1160 1028 HYDRA.exe ufx.exe PID 1028 wrote to memory of 1160 1028 HYDRA.exe ufx.exe PID 1028 wrote to memory of 1160 1028 HYDRA.exe ufx.exe PID 1028 wrote to memory of 1160 1028 HYDRA.exe ufx.exe PID 1028 wrote to memory of 1160 1028 HYDRA.exe ufx.exe PID 1028 wrote to memory of 1960 1028 HYDRA.exe sant.exe PID 1028 wrote to memory of 1960 1028 HYDRA.exe sant.exe PID 1028 wrote to memory of 1960 1028 HYDRA.exe sant.exe PID 1028 wrote to memory of 1960 1028 HYDRA.exe sant.exe PID 1028 wrote to memory of 1292 1028 HYDRA.exe power.exe PID 1028 wrote to memory of 1292 1028 HYDRA.exe power.exe PID 1028 wrote to memory of 1292 1028 HYDRA.exe power.exe PID 1028 wrote to memory of 1292 1028 HYDRA.exe power.exe PID 2028 wrote to memory of 1764 2028 yaya.exe starter.exe PID 2028 wrote to memory of 1764 2028 yaya.exe starter.exe PID 2028 wrote to memory of 1764 2028 yaya.exe starter.exe PID 2028 wrote to memory of 1764 2028 yaya.exe starter.exe PID 1160 wrote to memory of 1116 1160 ufx.exe usc.exe PID 1160 wrote to memory of 1116 1160 ufx.exe usc.exe PID 1160 wrote to memory of 1116 1160 ufx.exe usc.exe PID 1160 wrote to memory of 1116 1160 ufx.exe usc.exe PID 1160 wrote to memory of 1116 1160 ufx.exe usc.exe PID 1160 wrote to memory of 1116 1160 ufx.exe usc.exe PID 1160 wrote to memory of 1116 1160 ufx.exe usc.exe PID 1116 wrote to memory of 972 1116 usc.exe SCHTASKS.exe PID 1116 wrote to memory of 972 1116 usc.exe SCHTASKS.exe PID 1116 wrote to memory of 972 1116 usc.exe SCHTASKS.exe PID 1116 wrote to memory of 972 1116 usc.exe SCHTASKS.exe PID 1116 wrote to memory of 972 1116 usc.exe SCHTASKS.exe PID 1116 wrote to memory of 972 1116 usc.exe SCHTASKS.exe PID 1116 wrote to memory of 972 1116 usc.exe SCHTASKS.exe PID 1960 wrote to memory of 1708 1960 sant.exe explorer.exe PID 1960 wrote to memory of 1708 1960 sant.exe explorer.exe PID 1960 wrote to memory of 1708 1960 sant.exe explorer.exe PID 1960 wrote to memory of 1708 1960 sant.exe explorer.exe PID 1764 wrote to memory of 1156 1764 starter.exe csc.exe PID 1764 wrote to memory of 1156 1764 starter.exe csc.exe PID 1764 wrote to memory of 1156 1764 starter.exe csc.exe PID 1156 wrote to memory of 1956 1156 csc.exe cvtres.exe PID 1156 wrote to memory of 1956 1156 csc.exe cvtres.exe PID 1156 wrote to memory of 1956 1156 csc.exe cvtres.exe PID 960 wrote to memory of 940 960 cmd.exe services.exe PID 960 wrote to memory of 940 960 cmd.exe services.exe PID 960 wrote to memory of 940 960 cmd.exe services.exe PID 788 wrote to memory of 1140 788 services.exe foxcon.exe PID 788 wrote to memory of 1140 788 services.exe foxcon.exe PID 788 wrote to memory of 1140 788 services.exe foxcon.exe PID 1292 wrote to memory of 936 1292 power.exe powershell.exe PID 1292 wrote to memory of 936 1292 power.exe powershell.exe PID 1292 wrote to memory of 936 1292 power.exe powershell.exe PID 1292 wrote to memory of 936 1292 power.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HYDRA.exePID:1028"C:\Users\Admin\AppData\Local\Temp\HYDRA.exe"Loads dropped DLLSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\yaya.exePID:2028C:\Users\Admin\AppData\Roaming\yaya.exeExecutes dropped EXELoads dropped DLLSuspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exePID:1764"C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe"Executes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exePID:1156"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vuivrozc.cmdline"Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exePID:1956C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA88.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDA87.tmp"
-
C:\Windows\System32\cmd.exePID:1320"C:\Windows\System32\cmd.exe"
-
C:\Windows\System32\cmd.exePID:960/K services.exe && clearSuspicious use of WriteProcessMemory
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exePID:940services.exeExecutes dropped EXEModifies data under HKEY_USERSSuspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exePID:1664"C:\Windows\System32\cmd.exe"
-
C:\Windows\System32\cmd.exePID:648net localgroup administrators %username% /add
-
C:\Users\Admin\AppData\Roaming\va.exePID:1212C:\Users\Admin\AppData\Roaming\va.exeExecutes dropped EXEDrops startup file
-
C:\Users\Admin\AppData\Roaming\ufx.exePID:1160C:\Users\Admin\AppData\Roaming\ufx.exeExecutes dropped EXELoads dropped DLLSuspicious use of WriteProcessMemory
-
C:\ProgramData\ucp\usc.exePID:1116"C:\ProgramData\ucp\usc.exe" /ucp/usc.exeExecutes dropped EXESuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SCHTASKS.exePID:972SCHTASKS /Create /SC MINUTE /MO 10 /F /TN SystemOptimize /TR C:\ProgramData\ucp\usc.exeCreates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\sant.exePID:1960C:\Users\Admin\AppData\Roaming\sant.exeExecutes dropped EXEMaps connected drives based on registrySuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exePID:1708explorer.exeAdds Run key to start application
-
C:\Users\Admin\AppData\Roaming\power.exePID:1292C:\Users\Admin\AppData\Roaming\power.exeExecutes dropped EXESuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:936"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exePID:788C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exeExecutes dropped EXEModifies data under HKEY_USERSSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\TEMP\foxcon.exePID:1140"C:\Windows\TEMP\foxcon.exe"Executes dropped EXEDrops file in System32 directoryModifies data under HKEY_USERSSuspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\ProgramData\ucp\usc.exe
-
C:\Users\Admin\AppData\Local\Temp\RESDA88.tmp
-
C:\Users\Admin\AppData\Local\Temp\vuivrozc.dll
-
C:\Users\Admin\AppData\Local\Temp\vuivrozc.pdb
-
C:\Users\Admin\AppData\Roaming\power.exe
-
C:\Users\Admin\AppData\Roaming\sant.exe
-
C:\Users\Admin\AppData\Roaming\sant.exe
-
C:\Users\Admin\AppData\Roaming\ufx.exe
-
C:\Users\Admin\AppData\Roaming\ufx.exe
-
C:\Users\Admin\AppData\Roaming\va.exe
-
C:\Users\Admin\AppData\Roaming\yaya.exe
-
C:\Users\Admin\AppData\Roaming\yaya.exe
-
C:\Windows\TEMP\foxcon.exe
-
C:\Windows\Temp\foxcon.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\Newtonsoft.Json.dll
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\foxcon.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\services.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
-
C:\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
-
\??\c:\Users\Admin\AppData\Local\Temp\CSCDA87.tmp
-
\??\c:\Users\Admin\AppData\Local\Temp\vuivrozc.0.cs
-
\??\c:\Users\Admin\AppData\Local\Temp\vuivrozc.cmdline
-
\ProgramData\ucp\usc.exe
-
\ProgramData\ucp\usc.exe
-
\ProgramData\ucp\usc.exe
-
\Users\Admin\AppData\Roaming\power.exe
-
\Users\Admin\AppData\Roaming\power.exe
-
\Users\Admin\AppData\Roaming\sant.exe
-
\Users\Admin\AppData\Roaming\sant.exe
-
\Users\Admin\AppData\Roaming\ufx.exe
-
\Users\Admin\AppData\Roaming\va.exe
-
\Users\Admin\AppData\Roaming\va.exe
-
\Users\Admin\AppData\Roaming\yaya.exe
-
\Windows\Temp\{1945BBS40-8571-3DA1-BB29-HYDRA7A13A1E}\starter.exe
-
memory/788-54-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/788-53-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/856-36-0x000007FEF7140000-0x000007FEF73BA000-memory.dmp
-
memory/936-63-0x0000000000000000-mapping.dmp
-
memory/936-64-0x0000000072B50000-0x000000007323E000-memory.dmp
-
memory/936-65-0x0000000000510000-0x0000000000511000-memory.dmp
-
memory/936-66-0x00000000047C0000-0x00000000047C1000-memory.dmp
-
memory/936-67-0x00000000025D0000-0x00000000025D1000-memory.dmp
-
memory/936-68-0x00000000053A0000-0x00000000053A1000-memory.dmp
-
memory/940-50-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/940-51-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/940-47-0x0000000000000000-mapping.dmp
-
memory/972-34-0x0000000000000000-mapping.dmp
-
memory/1116-31-0x0000000000000000-mapping.dmp
-
memory/1140-60-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/1140-59-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/1140-56-0x0000000000000000-mapping.dmp
-
memory/1156-39-0x0000000000000000-mapping.dmp
-
memory/1160-9-0x0000000000000000-mapping.dmp
-
memory/1212-5-0x0000000000000000-mapping.dmp
-
memory/1292-21-0x0000000000000000-mapping.dmp
-
memory/1708-37-0x0000000000000000-mapping.dmp
-
memory/1708-38-0x0000000000520000-0x00000000007A1000-memory.dmp
-
memory/1764-33-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/1764-35-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp
-
memory/1764-25-0x0000000000000000-mapping.dmp
-
memory/1956-42-0x0000000000000000-mapping.dmp
-
memory/1960-15-0x0000000000000000-mapping.dmp
-
memory/2028-23-0x0000000002B80000-0x0000000002B81000-memory.dmp
-
memory/2028-11-0x0000000002B80000-0x0000000002B81000-memory.dmp
-
memory/2028-1-0x0000000000000000-mapping.dmp