pony | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

resource	yara_rule
C:\Users\Admin\AppData\Roaming\1605791984389.exe	Nirsoft
C:\Users\Admin\AppData\Roaming\1605791984389.exe	Nirsoft
C:\Users\Admin\AppData\Roaming\1605791987088.exe	Nirsoft
C:\Users\Admin\AppData\Roaming\1605791987088.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	Nirsoft

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral27/memory/1440-65-0x0000000004DD0000-0x0000000004DD9000-memory.dmp	rezer0

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

12 200 rundll32.exe

flow	pid	process
12	200	rundll32.exe

Executes dropped EXE 18 IoCs

Processes:

keygen-pr.exekeygen-step-3.exekeygen-step-4.exekey.exeSetup.exekey.exe1605791984389.exeBTRSetp.exe1605791987088.exeBTRSetp.exeBTRSetp.exejuppp.exejfiag_gg.exejfiag_gg.exeid6.exelcx.exesetup_full.exewyfdggaa.exe

pid	process
3284	keygen-pr.exe
3596	keygen-step-3.exe
3908	keygen-step-4.exe
2052	key.exe
984	Setup.exe
4084	key.exe
864	1605791984389.exe
1440	BTRSetp.exe
4220	1605791987088.exe
4364	BTRSetp.exe
4376	BTRSetp.exe
4396	juppp.exe
4480	jfiag_gg.exe
4608	jfiag_gg.exe
4684	id6.exe
4736	lcx.exe
816	setup_full.exe
4408	wyfdggaa.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	upx

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

juppp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kissq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kissq.exe"	juppp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Setup.exewyfdggaa.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wyfdggaa.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ip-api.com
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

Setup.exerundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Setup.exe
File opened for modification \??\PhysicalDrive0 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Setup.exe

pid process

984 Setup.exe

flow	ioc
20	ip-api.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Setup.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	process
984	Setup.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

key.exeSetup.exerundll32.exeBTRSetp.exe

description	pid	process	target process
PID 2052 set thread context of 4084	2052	key.exe	key.exe
PID 984 set thread context of 200	984	Setup.exe	rundll32.exe
PID 984 set thread context of 1716	984	Setup.exe	rundll32.exe
PID 984 set thread context of 568	984	Setup.exe	rundll32.exe
PID 568 set thread context of 4252	568	rundll32.exe	rundll32.exe
PID 1440 set thread context of 4376	1440	BTRSetp.exe	BTRSetp.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4536 4376 WerFault.exe BTRSetp.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2144 taskkill.exe
2120 taskkill.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

pid	pid_target	process	target process
4536	4376	WerFault.exe	BTRSetp.exe

pid	process
2144	taskkill.exe
2120	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\NumberOfSubdomai = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\ = "669"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658B = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = b053313aa9bed601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 21c3fdda76bed601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\Total = "651"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\Total = "669"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{BDB76443-E6F3-4EA7-9893-8F806D3E17B9} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{85A24B7A-FD81-4617-910A-0C0A1F9DE8CE}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "651"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8e27e1da76bed601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\5FF1348C80820F2A98 = 0300000001000000140000005ff1348c80820f2a988d0c0c7abea0ea394b5e6c040000000100000010000000fd42404f68fae3f0d490e8d19d08ab1d0f00000001000000200000005546bb2210de2560292e6f4610af4ffbdb453f9bf9983e62942c35959e16038d140000000100000014000000b3b30880146b0eb235e8e136e7d15c9c4847f5f3190000000100000010000000e142e209d34bfb2eac257eb76a2b61e15c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000e5050000308205e1308203c9a0030201020213330000016fd585f24b93e88a0700000000016f300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3139313231323030303333315a170d3231303331323030303333315a3081a3310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3121301f06092a864886f70d010901161271666265406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb24782c35c66c63688c01ed857df9a4330b81628c86831de4d577f8cb2155b880ee41953a18ac28de644bacfa97558ec6f522490f103b7fa0092430f8e0ba55c36dd91f6f1f91baec6eb3581d89133141e1580e02ec2445e5380b178f92f81e97193be8be1223d36e5f2be070a3db6ac17987ea3b42d15994c73a10e64794da4660a5d875e179c567bb06ecfd7cbf4c1ee4fe453284e72877d746a3e178788a1bd540ba9250a931a11105bb98f1b2b757fa6c5ade16e7cc1d1628fedb716018526f5b56630b54cd5f75f938e9b4a956609cc441aac84a10a101f6429b6fceb9434a41b24f0ca9781bf72b010f14bd13dc5d996b6ed6c4d53156969dd04f7390203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414b3b30880146b0eb235e8e136e7d15c9c4847f5f3301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038202010064d81278e224099c122690412271d5f2d92ae1c00f7135d64f63663ccc0588826bf24cc6cffa0d6666b7e3f989825dd1021fd1bdc6a9d4a492c0f46198534382204d8668b0f3c8d85f9f614f7fff47e391a4fdc89dba1b423f1d2a8d4986ff42bac032a21224b246b03ffef26e7da49d3ef381ff9d669cda0234445bff395be1b70627f013ccde692280d75d690b4f4c5e3a123b379bd30bdc6cf1af0c69d97eb0aa4f580eb4e876465b2c62514a612a3971f6bc6ace33f569e0cbcbd5498caf2af949952c310221a382d0a7fbc4594b0bfe96a1c81d26639b249beea28179ead8377bf70e9a09596997af2b405c5425a1e5e6e46b065016901b7cd120e2389d47924b1f834955135461f7592c9487e3910bf0de382ad5906dd8c46b321b176698caaec19d1ee10aa6679981d8f2f5c40d69240a7075ce4341305d2bbd082e03c81c41baeb557b41904482ae88d0566f339ab517ae2f84223d567f9ec734c1c5a2be39aa24c49930b6428bbe2fa300f2369e1c8cc554c14010f1ee518afa32e4bf0a15cb251d37791338f5ade8ced4b67ca5fc56320c2c2973f9b13e250dabe4a373580becf787afd552c6b293dfc7bfb1f67739c64df74ae3d373e2db9c27090fe15e58591824e4f150602af628917a6d1353919cd0a8489596f97070833a98b34c2d3a0ebafda2f81096533b773c5914d7f05e66cb17af2bcd11ad517440b5	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "312565665"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Enabled = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

1476 PING.EXE
696 PING.EXE
1212 PING.EXE

pid	process
1476	PING.EXE
696	PING.EXE
1212	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

1605791984389.exe1605791987088.exekey.exeBTRSetp.exeWerFault.exejfiag_gg.exe

pid	process
864	1605791984389.exe
864	1605791984389.exe
4220	1605791987088.exe
4220	1605791987088.exe
2052	key.exe
2052	key.exe
1440	BTRSetp.exe
1440	BTRSetp.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4608	jfiag_gg.exe
4608	jfiag_gg.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

3820 MicrosoftEdgeCP.exe
3820 MicrosoftEdgeCP.exe

pid	process
3820	MicrosoftEdgeCP.exe
3820	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

Processes:

taskkill.exetaskkill.exekey.exeBTRSetp.exeWerFault.exeMicrosoftEdge.exeMicrosoftEdgeCP.exewyfdggaa.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeDebugPrivilege	1440	BTRSetp.exe
Token: SeRestorePrivilege	4536	WerFault.exe
Token: SeBackupPrivilege	4536	WerFault.exe
Token: SeDebugPrivilege	4536	WerFault.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeManageVolumePrivilege	4408	wyfdggaa.exe
Token: SeManageVolumePrivilege	4408	wyfdggaa.exe
Token: SeDebugPrivilege	1896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1896	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

rundll32.exeid6.exeMicrosoftEdge.exewyfdggaa.exeMicrosoftEdgeCP.exe

pid	process
4252	rundll32.exe
4684	id6.exe
4684	id6.exe
4312	MicrosoftEdge.exe
4408	wyfdggaa.exe
3820	MicrosoftEdgeCP.exe
3820	MicrosoftEdgeCP.exe
4408	wyfdggaa.exe
4408	wyfdggaa.exe
4408	wyfdggaa.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Magic_File_v3_keygen_by_KeygenNinja.execmd.exekeygen-step-3.exekeygen-pr.execmd.exekeygen-step-4.exekey.exeSetup.exerundll32.exe

description	pid	process	target process
PID 912 wrote to memory of 196	912	Magic_File_v3_keygen_by_KeygenNinja.exe	cmd.exe
PID 912 wrote to memory of 196	912	Magic_File_v3_keygen_by_KeygenNinja.exe	cmd.exe
PID 912 wrote to memory of 196	912	Magic_File_v3_keygen_by_KeygenNinja.exe	cmd.exe
PID 196 wrote to memory of 3284	196	cmd.exe	keygen-pr.exe
PID 196 wrote to memory of 3284	196	cmd.exe	keygen-pr.exe
PID 196 wrote to memory of 3284	196	cmd.exe	keygen-pr.exe
PID 196 wrote to memory of 3596	196	cmd.exe	keygen-step-3.exe
PID 196 wrote to memory of 3596	196	cmd.exe	keygen-step-3.exe
PID 196 wrote to memory of 3596	196	cmd.exe	keygen-step-3.exe
PID 3596 wrote to memory of 3904	3596	keygen-step-3.exe	cmd.exe
PID 3596 wrote to memory of 3904	3596	keygen-step-3.exe	cmd.exe
PID 3596 wrote to memory of 3904	3596	keygen-step-3.exe	cmd.exe
PID 196 wrote to memory of 3908	196	cmd.exe	keygen-step-4.exe
PID 196 wrote to memory of 3908	196	cmd.exe	keygen-step-4.exe
PID 196 wrote to memory of 3908	196	cmd.exe	keygen-step-4.exe
PID 3284 wrote to memory of 2052	3284	keygen-pr.exe	key.exe
PID 3284 wrote to memory of 2052	3284	keygen-pr.exe	key.exe
PID 3284 wrote to memory of 2052	3284	keygen-pr.exe	key.exe
PID 3904 wrote to memory of 1476	3904	cmd.exe	PING.EXE
PID 3904 wrote to memory of 1476	3904	cmd.exe	PING.EXE
PID 3904 wrote to memory of 1476	3904	cmd.exe	PING.EXE
PID 3908 wrote to memory of 984	3908	keygen-step-4.exe	Setup.exe
PID 3908 wrote to memory of 984	3908	keygen-step-4.exe	Setup.exe
PID 3908 wrote to memory of 984	3908	keygen-step-4.exe	Setup.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 2004	984	Setup.exe	cmd.exe
PID 984 wrote to memory of 2004	984	Setup.exe	cmd.exe
PID 984 wrote to memory of 2004	984	Setup.exe	cmd.exe
PID 200 wrote to memory of 864	200	rundll32.exe	1605791984389.exe

C:\Users\Admin\AppData\Local\Temp\Magic_File_v3_keygen_by_KeygenNinja.exe
"C:\Users\Admin\AppData\Local\Temp\Magic_File_v3_keygen_by_KeygenNinja.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:196
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        Executes dropped EXE
        
        PID:4084
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:1476
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe 001 install5
        5⤵
        Blocklisted process makes network request
        Writes to the Master Boot Record (MBR)
        Suspicious use of WriteProcessMemory
        
        PID:200
      - C:\Users\Admin\AppData\Roaming\1605791984389.exe
        
        "C:\Users\Admin\AppData\Roaming\1605791984389.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605791984389.txt"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:864
      - C:\Users\Admin\AppData\Roaming\1605791987088.exe
        
        "C:\Users\Admin\AppData\Roaming\1605791987088.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605791987088.txt"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4220
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe 002 install5
        5⤵
        
        PID:1716
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im firefox.exe
        6⤵
        
        PID:796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im firefox.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2120
    - - C:\Windows\SysWOW64\rundll32.exe
        
        C:\Windows\system32\rundll32.exe 003 install5
        5⤵
        Suspicious use of SetThreadContext
        
        PID:568
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4252
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
        5⤵
        
        PID:2004
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        6⤵
        Runs ping.exe
        
        PID:696
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        
        PID:4376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1408
        6⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4536
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
        5⤵
        Executes dropped EXE
        
        PID:4480
    - - C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\lcx.exe
        
        lcx.exe version2.txt
        5⤵
        Executes dropped EXE
        
        PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe"
      4⤵
      Executes dropped EXE
      PID:816
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe"
        5⤵
        
        PID:2056
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        6⤵
        Runs ping.exe
        
        PID:1212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\DreamTrips.bat" "
      4⤵
      Checks computer location settings
      PID:1428
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4312

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3840

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3648

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\InetCookies\BPNKC7V0.cookie

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\potato.dat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Config.ini

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\DreamTrips.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe

MD5
4daaeeeba9222078c92a61b2dabbe1d3

SHA1
0efc3cf265a697995a318eb2ac1ea2854af4d4cd

SHA256
a3d1bbbae88dc886822c41503e47fb2d475160d81f99ab6621d60cfa59b3effd

SHA512
2f8b73a414f96a36b54ed703054fb2a43ea2799d21076a2be75b8c5e7b49245d9a836a9dc1b5413f08366927a4839d158aa8f2c8b3b7589b5f0639b5a807dde4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe

MD5
4daaeeeba9222078c92a61b2dabbe1d3

SHA1
0efc3cf265a697995a318eb2ac1ea2854af4d4cd

SHA256
a3d1bbbae88dc886822c41503e47fb2d475160d81f99ab6621d60cfa59b3effd

SHA512
2f8b73a414f96a36b54ed703054fb2a43ea2799d21076a2be75b8c5e7b49245d9a836a9dc1b5413f08366927a4839d158aa8f2c8b3b7589b5f0639b5a807dde4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\lcx.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\lcx.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\version2.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe

MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe

MD5
4d4c98eca32b14aeb074db34cd0881e4

SHA1
92f213d609bba05d41d6941652a88c44936663a4

SHA256
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

SHA512
959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe

MD5
4d4c98eca32b14aeb074db34cd0881e4

SHA1
92f213d609bba05d41d6941652a88c44936663a4

SHA256
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

SHA512
959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

Download Submit
C:\Users\Admin\AppData\Roaming\1605791984389.exe

MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791984389.exe

MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791984389.txt

Download Submit
C:\Users\Admin\AppData\Roaming\1605791987088.exe

MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791987088.exe

MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791987088.txt

Download Submit
memory/196-0-0x0000000000000000-mapping.dmp

Download
memory/200-31-0x0000000010000000-0x00000000101FE000-memory.dmp

Filesize
2.0MB

Download
memory/200-29-0x0000000000035FB0-mapping.dmp

Download
memory/200-32-0x00000000045B0000-0x00000000047A0000-memory.dmp

Filesize
1.9MB

Download
memory/568-41-0x0000000004370000-0x0000000004560000-memory.dmp

Filesize
1.9MB

Download
memory/568-33-0x0000000000035FB0-mapping.dmp

Download
memory/696-48-0x0000000000000000-mapping.dmp

Download
memory/796-42-0x0000000000000000-mapping.dmp

Download
memory/816-232-0x0000000000000000-mapping.dmp

Download
memory/864-37-0x0000000000000000-mapping.dmp

Download
memory/984-28-0x0000000010000000-0x0000000010196000-memory.dmp

Filesize
1.6MB

Download
memory/984-20-0x0000000000000000-mapping.dmp

Download
memory/984-23-0x0000000073FE0000-0x0000000074073000-memory.dmp

Filesize
588KB

Download
memory/1212-237-0x0000000000000000-mapping.dmp

Download
memory/1428-236-0x0000000000000000-mapping.dmp

Download
memory/1440-57-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/1440-54-0x00000000027E0000-0x00000000027F7000-memory.dmp

Filesize
92KB

Download
memory/1440-47-0x0000000071220000-0x000000007190E000-memory.dmp

Filesize
6.9MB

Download
memory/1440-65-0x0000000004DD0000-0x0000000004DD9000-memory.dmp

Filesize
36KB

Download
memory/1440-66-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/1440-49-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/1440-40-0x0000000000000000-mapping.dmp

Download
memory/1440-52-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/1440-55-0x0000000002800000-0x000000000280B000-memory.dmp

Filesize
44KB

Download
memory/1476-15-0x0000000000000000-mapping.dmp

Download
memory/1716-30-0x0000000000035FB0-mapping.dmp

Download
memory/1716-36-0x0000000004280000-0x0000000004470000-memory.dmp

Filesize
1.9MB

Download
memory/2004-35-0x0000000000000000-mapping.dmp

Download
memory/2052-16-0x0000000000000000-mapping.dmp

Download
memory/2056-235-0x0000000000000000-mapping.dmp

Download
memory/2120-53-0x0000000000000000-mapping.dmp

Download
memory/2144-50-0x0000000000000000-mapping.dmp

Download
memory/3284-2-0x0000000000000000-mapping.dmp

Download
memory/3284-3-0x0000000000000000-mapping.dmp

Download
memory/3444-38-0x0000000000000000-mapping.dmp

Download
memory/3596-7-0x0000000000000000-mapping.dmp

Download
memory/3596-6-0x0000000000000000-mapping.dmp

Download
memory/3904-10-0x0000000000000000-mapping.dmp

Download
memory/3908-12-0x0000000000000000-mapping.dmp

Download
memory/3908-11-0x0000000000000000-mapping.dmp

Download
memory/4084-27-0x0000000000400000-0x0000000000983000-memory.dmp

Filesize
5.5MB

Download
memory/4084-25-0x000000000066C0BC-mapping.dmp

Download
memory/4084-24-0x0000000000400000-0x0000000000983000-memory.dmp

Filesize
5.5MB

Download
memory/4220-58-0x0000000000000000-mapping.dmp

Download
memory/4252-62-0x0000000000035FB0-mapping.dmp

Download
memory/4252-63-0x0000000010000000-0x0000000010051000-memory.dmp

Filesize
324KB

Download
memory/4376-68-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4376-83-0x0000000000401A01-mapping.dmp

Download
memory/4376-253-0x0000000000401A01-mapping.dmp

Download
memory/4376-252-0x0000000000401A01-mapping.dmp

Download
memory/4376-84-0x0000000000401A01-mapping.dmp

Download
memory/4376-249-0x0000000000401A01-mapping.dmp

Download
memory/4376-85-0x0000000000401A01-mapping.dmp

Download
memory/4376-86-0x0000000000401A01-mapping.dmp

Download
memory/4376-87-0x0000000000401A01-mapping.dmp

Download
memory/4376-180-0x0000000000401A01-mapping.dmp

Download
memory/4376-181-0x0000000000401A01-mapping.dmp

Download
memory/4376-179-0x0000000000401A01-mapping.dmp

Download
memory/4376-182-0x0000000000401A01-mapping.dmp

Download
memory/4376-184-0x0000000000401A01-mapping.dmp

Download
memory/4376-183-0x0000000000401A01-mapping.dmp

Download
memory/4376-185-0x0000000000401A01-mapping.dmp

Download
memory/4376-187-0x0000000000401A01-mapping.dmp

Download
memory/4376-188-0x0000000000401A01-mapping.dmp

Download
memory/4376-186-0x0000000000401A01-mapping.dmp

Download
memory/4376-251-0x0000000000401A01-mapping.dmp

Download
memory/4376-88-0x0000000000401A01-mapping.dmp

Download
memory/4376-250-0x0000000000401A01-mapping.dmp

Download
memory/4376-82-0x0000000000401A01-mapping.dmp

Download
memory/4376-81-0x0000000000401A01-mapping.dmp

Download
memory/4376-80-0x0000000000401A01-mapping.dmp

Download
memory/4376-79-0x0000000000401A01-mapping.dmp

Download
memory/4376-247-0x0000000000401A01-mapping.dmp

Download
memory/4376-248-0x0000000000401A01-mapping.dmp

Download
memory/4376-246-0x0000000000401A01-mapping.dmp

Download
memory/4376-245-0x0000000000401A01-mapping.dmp

Download
memory/4376-69-0x0000000000401A01-mapping.dmp

Download
memory/4376-72-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/4396-71-0x0000000000000000-mapping.dmp

Download
memory/4408-239-0x0000000000000000-mapping.dmp

Download
memory/4480-75-0x0000000000000000-mapping.dmp

Download
memory/4536-78-0x0000000004740000-0x0000000004741000-memory.dmp

Filesize
4KB

Download
memory/4536-189-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/4536-91-0x0000000005340000-0x0000000005341000-memory.dmp

Filesize
4KB

Download
memory/4608-90-0x0000000000000000-mapping.dmp

Download
memory/4684-104-0x0000000000000000-mapping.dmp

Download
memory/4736-242-0x0000000010000000-0x00000000100E3000-memory.dmp

Filesize
908KB

Download
memory/4736-112-0x0000000000000000-mapping.dmp

Download