Overview
overview
10Static
static
8 (1).exe
windows10_x64
108 (10).exe
windows10_x64
108 (11).exe
windows10_x64
108 (12).exe
windows10_x64
108 (13).exe
windows10_x64
108 (14).exe
windows10_x64
108 (15).exe
windows10_x64
108 (16).exe
windows10_x64
108 (17).exe
windows10_x64
108 (18).exe
windows10_x64
108 (19).exe
windows10_x64
108 (2).exe
windows10_x64
108 (20).exe
windows10_x64
108 (21).exe
windows10_x64
108 (22).exe
windows10_x64
108 (23).exe
windows10_x64
108 (24).exe
windows10_x64
108 (25).exe
windows10_x64
108 (26).exe
windows10_x64
108 (27).exe
windows10_x64
108 (28).exe
windows10_x64
108 (29).exe
windows10_x64
108 (3).exe
windows10_x64
8 (30).exe
windows10_x64
108 (31).exe
windows10_x64
108 (4).exe
windows10_x64
108 (5).exe
windows10_x64
108 (6).exe
windows10_x64
108 (7).exe
windows10_x64
108 (8).exe
windows10_x64
108 (9).exe
windows10_x64
108.exe
windows10_x64
10Analysis
-
max time kernel
1801s -
max time network
1809s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-07-2021 22:18
Static task
static1
Behavioral task
behavioral1
Sample
8 (1).exe
Resource
win10v20210410
Behavioral task
behavioral2
Sample
8 (10).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
8 (11).exe
Resource
win10v20210410
Behavioral task
behavioral4
Sample
8 (12).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
8 (13).exe
Resource
win10v20210410
Behavioral task
behavioral6
Sample
8 (14).exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
8 (15).exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
8 (16).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
8 (17).exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
8 (18).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
8 (19).exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
8 (2).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
8 (20).exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
8 (21).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
8 (22).exe
Resource
win10v20210410
Behavioral task
behavioral16
Sample
8 (23).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
8 (24).exe
Resource
win10v20210410
Behavioral task
behavioral18
Sample
8 (25).exe
Resource
win10v20210408
Behavioral task
behavioral19
Sample
8 (26).exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
8 (27).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
8 (28).exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
8 (29).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
8 (3).exe
Resource
win10v20210408
Behavioral task
behavioral24
Sample
8 (30).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
8 (31).exe
Resource
win10v20210408
Behavioral task
behavioral26
Sample
8 (4).exe
Resource
win10v20210410
Behavioral task
behavioral27
Sample
8 (5).exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
8 (6).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
8 (7).exe
Resource
win10v20210410
Behavioral task
behavioral30
Sample
8 (8).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
8 (9).exe
Resource
win10v20210410
General
-
Target
8 (16).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
redline
AniNEW
akedauiver.xyz:80
Extracted
vidar
39.6
903
https://sslamlssa1.tumblr.com/
-
profile_id
903
Extracted
vidar
39.6
865
https://sslamlssa1.tumblr.com/
-
profile_id
865
Extracted
fickerstealer
37.0.8.225:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXerUNdlL32.eXerUNdlL32.eXerUNdlL32.eXerUNdlL32.eXerUNdlL32.eXerUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3088 2108 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4620 2108 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5520 2108 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8884 2108 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7376 2108 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8752 2108 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8188 2108 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\_5ESty5sWL_a7y2OwqlBufqt.exe family_redline behavioral8/memory/3088-294-0x0000000000417E1A-mapping.dmp family_redline behavioral8/memory/3088-291-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral8/memory/2864-370-0x0000000000417E1E-mapping.dmp family_redline behavioral8/memory/1432-376-0x0000000000417E26-mapping.dmp family_redline behavioral8/memory/792-389-0x0000000000417DEA-mapping.dmp family_redline behavioral8/memory/3080-412-0x0000000000417DEA-mapping.dmp family_redline behavioral8/memory/3920-446-0x0000000000417DEE-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 4388 created 3096 4388 WerFault.exe sonia_3.exe PID 3684 created 4932 3684 WerFault.exe setup.exe PID 5232 created 5068 5232 WerFault.exe gcN4vjRaRQ09r0mmKWbHNSmo.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 5920 created 6784 5920 svchost.exe ly60ll32L_bDjXxDUQk8yzy6.exe PID 5920 created 10000 5920 svchost.exe G7dAGg_eGgIHhLv_Brh_9sUS.exe PID 5920 created 4464 5920 svchost.exe o6tyyvv7EPRdJIGDuT6jagBr.exe PID 5920 created 8372 5920 svchost.exe vyoyD3NZn6Pqk13vHQw_Ts41.exe -
Processes:
resource yara_rule behavioral8/memory/3088-294-0x0000000000417E1A-mapping.dmp Redline_stealer2 behavioral8/memory/3088-291-0x0000000000400000-0x000000000041E000-memory.dmp Redline_stealer2 behavioral8/memory/2864-370-0x0000000000417E1E-mapping.dmp Redline_stealer2 behavioral8/memory/1432-376-0x0000000000417E26-mapping.dmp Redline_stealer2 behavioral8/memory/792-389-0x0000000000417DEA-mapping.dmp Redline_stealer2 behavioral8/memory/3080-412-0x0000000000417DEA-mapping.dmp Redline_stealer2 behavioral8/memory/3920-446-0x0000000000417DEE-mapping.dmp Redline_stealer2 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 6 IoCs
Processes:
resource yara_rule behavioral8/memory/3096-180-0x0000000000B40000-0x0000000000BDD000-memory.dmp family_vidar behavioral8/memory/3096-181-0x0000000000400000-0x00000000008F2000-memory.dmp family_vidar behavioral8/memory/4628-416-0x000000000046B76D-mapping.dmp family_vidar behavioral8/memory/4628-423-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar behavioral8/memory/2596-457-0x0000000000400000-0x00000000009F0000-memory.dmp family_vidar behavioral8/memory/2596-453-0x0000000000C50000-0x0000000000CED000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS89819B14\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS89819B14\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS89819B14\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS89819B14\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS89819B14\libcurl.dll aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exesonia_1.exesonia_2.exesonia_4.exesonia_3.exesonia_5.exesonia_6.exesonia_1.exejfiag3g_gg.exeLzmwAqmV.exejhuuee.exejfiag3g_gg.exeOLKbrowser.exesetup 326.exesetup.exewinnetdriv.exezhangd.exeChrome Update.exejfiag3g_gg.exex2Ezdo1WDoaOcNFcxcdqmBxR.exeIsJLKYUTzY9fr08H7FNU_XXs.exeDv_HhgDriI7E8LCdR1AMfCzv.exeAcre.exe.comOLKbrowser.exe_5ESty5sWL_a7y2OwqlBufqt.exeOLKbrowser.exeO2HBLFHTLSJK5EEyQvzwv1o6.exefindstr.execmd.exesePN_ed_pQIVAhbqiwAo62Gi.exe0T_CfNP7TR6rGwMHJJIlVryI.exeqAwAsVYs2wyfxP1hwERTSait.exeOXjOeGlru723sf_BuDje2WXH.exe4486494.exegcN4vjRaRQ09r0mmKWbHNSmo.exesIPK633F8oHtxQ6lzprM1BOp.exeo6tyyvv7EPRdJIGDuT6jagBr.exeL_jpmMmtCmkp04E2BqzHCb38.exeAv4kbwzXK8TNAii39Sv4jb0Y.exeI8T1zkNsiM_caTETk47Dvn1m.exe2Hcs3_JBb4EnNxyNL7BtQoRb.exejfiag3g_gg.exex2Ezdo1WDoaOcNFcxcdqmBxR.exeQO8lSQzThBPlzP5OHIQ5dmMH.exeDv_HhgDriI7E8LCdR1AMfCzv.exeIsJLKYUTzY9fr08H7FNU_XXs.exen8u6wwQhmD5FNpX6fCXZvd7k.exeqAwAsVYs2wyfxP1hwERTSait.exex2Ezdo1WDoaOcNFcxcdqmBxR.exezhangd.exeqAwAsVYs2wyfxP1hwERTSait.exesIPK633F8oHtxQ6lzprM1BOp.exesIPK633F8oHtxQ6lzprM1BOp.exeUpdater.exesetup_installer.exeI8T1zkNsiM_caTETk47Dvn1m.exesetup_install.exePING.EXEkarotima_1.exekarotima_2.exe7280200.exekarotima_2.exe2237588.exepid process 2200 setup_installer.exe 3616 setup_install.exe 1140 sonia_1.exe 3104 sonia_2.exe 2128 sonia_4.exe 3096 sonia_3.exe 2152 sonia_5.exe 1676 sonia_6.exe 4040 sonia_1.exe 1908 jfiag3g_gg.exe 2344 LzmwAqmV.exe 4484 jhuuee.exe 4588 jfiag3g_gg.exe 4604 OLKbrowser.exe 4812 setup 326.exe 4932 setup.exe 5012 winnetdriv.exe 5024 zhangd.exe 4136 Chrome Update.exe 4320 jfiag3g_gg.exe 4228 x2Ezdo1WDoaOcNFcxcdqmBxR.exe 4428 IsJLKYUTzY9fr08H7FNU_XXs.exe 4492 Dv_HhgDriI7E8LCdR1AMfCzv.exe 4296 Acre.exe.com 3940 OLKbrowser.exe 4748 _5ESty5sWL_a7y2OwqlBufqt.exe 3088 OLKbrowser.exe 488 O2HBLFHTLSJK5EEyQvzwv1o6.exe 1756 findstr.exe 5116 cmd.exe 4800 sePN_ed_pQIVAhbqiwAo62Gi.exe 5040 0T_CfNP7TR6rGwMHJJIlVryI.exe 4480 qAwAsVYs2wyfxP1hwERTSait.exe 2392 OXjOeGlru723sf_BuDje2WXH.exe 2596 4486494.exe 5068 gcN4vjRaRQ09r0mmKWbHNSmo.exe 3000 sIPK633F8oHtxQ6lzprM1BOp.exe 4464 o6tyyvv7EPRdJIGDuT6jagBr.exe 4224 L_jpmMmtCmkp04E2BqzHCb38.exe 4868 Av4kbwzXK8TNAii39Sv4jb0Y.exe 5048 I8T1zkNsiM_caTETk47Dvn1m.exe 1744 2Hcs3_JBb4EnNxyNL7BtQoRb.exe 4552 jfiag3g_gg.exe 4188 x2Ezdo1WDoaOcNFcxcdqmBxR.exe 1868 QO8lSQzThBPlzP5OHIQ5dmMH.exe 2864 Dv_HhgDriI7E8LCdR1AMfCzv.exe 1432 IsJLKYUTzY9fr08H7FNU_XXs.exe 792 n8u6wwQhmD5FNpX6fCXZvd7k.exe 4580 qAwAsVYs2wyfxP1hwERTSait.exe 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe 4104 zhangd.exe 4628 qAwAsVYs2wyfxP1hwERTSait.exe 524 sIPK633F8oHtxQ6lzprM1BOp.exe 3920 sIPK633F8oHtxQ6lzprM1BOp.exe 4204 Updater.exe 4128 setup_installer.exe 2272 I8T1zkNsiM_caTETk47Dvn1m.exe 5000 setup_install.exe 5464 PING.EXE 5640 karotima_1.exe 5648 karotima_2.exe 5940 7280200.exe 5988 karotima_2.exe 6072 2237588.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule behavioral8/memory/4868-354-0x0000000000400000-0x000000000064F000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 24 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2Hcs3_JBb4EnNxyNL7BtQoRb.exeJjZDSvbNDxAZqKXnnN92hKhL.exem_dHPxV3CoK8c5hyX6vGMrzv.exeCsgUijERrsmTrbESACC5X25M.exeVM5_8Vz9RniAnjqgCuzqy46q.exeDeQFayi1FpMd0IqpH017YESY.exesePN_ed_pQIVAhbqiwAo62Gi.exeL_jpmMmtCmkp04E2BqzHCb38.exeEHO8lR_vjhpbFvHsoZdsIht2.exesVd43iem2yJnbjSynxJ6INV_.exe8hnXvxWeZzvZ4RJFAD1R0GWj.exesSFRnOcrAlH5JfAkeVy8QUwH.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2Hcs3_JBb4EnNxyNL7BtQoRb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion JjZDSvbNDxAZqKXnnN92hKhL.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion m_dHPxV3CoK8c5hyX6vGMrzv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion CsgUijERrsmTrbESACC5X25M.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion VM5_8Vz9RniAnjqgCuzqy46q.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DeQFayi1FpMd0IqpH017YESY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion sePN_ed_pQIVAhbqiwAo62Gi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion L_jpmMmtCmkp04E2BqzHCb38.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DeQFayi1FpMd0IqpH017YESY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion EHO8lR_vjhpbFvHsoZdsIht2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion sePN_ed_pQIVAhbqiwAo62Gi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion sVd43iem2yJnbjSynxJ6INV_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion sVd43iem2yJnbjSynxJ6INV_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion EHO8lR_vjhpbFvHsoZdsIht2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion m_dHPxV3CoK8c5hyX6vGMrzv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion VM5_8Vz9RniAnjqgCuzqy46q.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8hnXvxWeZzvZ4RJFAD1R0GWj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion L_jpmMmtCmkp04E2BqzHCb38.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2Hcs3_JBb4EnNxyNL7BtQoRb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8hnXvxWeZzvZ4RJFAD1R0GWj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion sSFRnOcrAlH5JfAkeVy8QUwH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion sSFRnOcrAlH5JfAkeVy8QUwH.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion JjZDSvbNDxAZqKXnnN92hKhL.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CsgUijERrsmTrbESACC5X25M.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
karotima_1.exeJb743l0yI2f5LBucAcIqTm0k.exeAcre.exe.comGp3dAZfPfqAEWlwXW__jn8bE.exeApgLkrLaPR0Rzq_3wl5r2_Vz.exesonia_5.exekarotima_1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation karotima_1.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Jb743l0yI2f5LBucAcIqTm0k.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Acre.exe.com Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Gp3dAZfPfqAEWlwXW__jn8bE.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation ApgLkrLaPR0Rzq_3wl5r2_Vz.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation sonia_5.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation karotima_1.exe -
Drops startup file 1 IoCs
Processes:
Acre.exe.comdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url Acre.exe.com -
Loads dropped DLL 53 IoCs
Processes:
setup_install.exesonia_2.exex2Ezdo1WDoaOcNFcxcdqmBxR.exerundll32.exesetup_install.exerundll32.exeqAwAsVYs2wyfxP1hwERTSait.exe4486494.exesetup_install.exesvchost.exetimeout.exeHrrK2U03KQjYUU8YWNsy54pB.exerundll32.exesetup_install.exerundll32.exe0DPbuhMgwwCQ3N8r_cWCgnLC.exeWaffaJ6PIVbmepD9h6ZMeqYf.exesetup_install.exeBB9OBV8FFuqpaGoG1hlsSKsY.exerundll32.exerundll32.execsfvcutcsfvcutcsfvcutpid process 3616 setup_install.exe 3616 setup_install.exe 3616 setup_install.exe 3616 setup_install.exe 3616 setup_install.exe 3616 setup_install.exe 3104 sonia_2.exe 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe 3744 rundll32.exe 5000 setup_install.exe 5000 setup_install.exe 5000 setup_install.exe 5000 setup_install.exe 5000 setup_install.exe 5488 rundll32.exe 4628 qAwAsVYs2wyfxP1hwERTSait.exe 4628 qAwAsVYs2wyfxP1hwERTSait.exe 2596 4486494.exe 2596 4486494.exe 7700 setup_install.exe 7700 setup_install.exe 7700 setup_install.exe 7700 setup_install.exe 7700 setup_install.exe 5920 svchost.exe 5920 svchost.exe 5676 timeout.exe 5676 timeout.exe 7988 HrrK2U03KQjYUU8YWNsy54pB.exe 7988 HrrK2U03KQjYUU8YWNsy54pB.exe 8992 rundll32.exe 6556 setup_install.exe 6556 setup_install.exe 6556 setup_install.exe 6556 setup_install.exe 6556 setup_install.exe 7840 rundll32.exe 8444 0DPbuhMgwwCQ3N8r_cWCgnLC.exe 8444 0DPbuhMgwwCQ3N8r_cWCgnLC.exe 6840 WaffaJ6PIVbmepD9h6ZMeqYf.exe 6840 WaffaJ6PIVbmepD9h6ZMeqYf.exe 9684 setup_install.exe 9684 setup_install.exe 9684 setup_install.exe 9684 setup_install.exe 9684 setup_install.exe 8504 BB9OBV8FFuqpaGoG1hlsSKsY.exe 8504 BB9OBV8FFuqpaGoG1hlsSKsY.exe 6892 rundll32.exe 8268 rundll32.exe 6436 csfvcut 5580 csfvcut 8988 csfvcut -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
sonia_6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
sePN_ed_pQIVAhbqiwAo62Gi.exeL_jpmMmtCmkp04E2BqzHCb38.exeVM5_8Vz9RniAnjqgCuzqy46q.exe8hnXvxWeZzvZ4RJFAD1R0GWj.exeAv4kbwzXK8TNAii39Sv4jb0Y.exeEHO8lR_vjhpbFvHsoZdsIht2.exem_dHPxV3CoK8c5hyX6vGMrzv.exesVd43iem2yJnbjSynxJ6INV_.exeDeQFayi1FpMd0IqpH017YESY.exexFg0Bc4hPArdysmZqZFiE8KC.exeJu5fMq_xUvPNzfkTGZQLheLd.exesSFRnOcrAlH5JfAkeVy8QUwH.exe2Hcs3_JBb4EnNxyNL7BtQoRb.exeJjZDSvbNDxAZqKXnnN92hKhL.exeCsgUijERrsmTrbESACC5X25M.exeCHmXPiT5MHZEaYEW0bU5zjOO.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sePN_ed_pQIVAhbqiwAo62Gi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA L_jpmMmtCmkp04E2BqzHCb38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA VM5_8Vz9RniAnjqgCuzqy46q.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8hnXvxWeZzvZ4RJFAD1R0GWj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Av4kbwzXK8TNAii39Sv4jb0Y.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA EHO8lR_vjhpbFvHsoZdsIht2.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA m_dHPxV3CoK8c5hyX6vGMrzv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sVd43iem2yJnbjSynxJ6INV_.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DeQFayi1FpMd0IqpH017YESY.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xFg0Bc4hPArdysmZqZFiE8KC.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Ju5fMq_xUvPNzfkTGZQLheLd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sSFRnOcrAlH5JfAkeVy8QUwH.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2Hcs3_JBb4EnNxyNL7BtQoRb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA JjZDSvbNDxAZqKXnnN92hKhL.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CsgUijERrsmTrbESACC5X25M.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA CHmXPiT5MHZEaYEW0bU5zjOO.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 179 ipinfo.io 181 ipinfo.io 283 api.ipify.org 476 ipinfo.io 477 ipinfo.io 9 ipinfo.io 14 ip-api.com 133 api.ipify.org 590 api.ipify.org 451 api.ipify.org 16 ipinfo.io 331 ipinfo.io 332 ipinfo.io -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent EFD3D52D187211BF svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
Processes:
sePN_ed_pQIVAhbqiwAo62Gi.exeL_jpmMmtCmkp04E2BqzHCb38.exe2Hcs3_JBb4EnNxyNL7BtQoRb.exeJjZDSvbNDxAZqKXnnN92hKhL.exeEHO8lR_vjhpbFvHsoZdsIht2.exesVd43iem2yJnbjSynxJ6INV_.exem_dHPxV3CoK8c5hyX6vGMrzv.exeCsgUijERrsmTrbESACC5X25M.exeVM5_8Vz9RniAnjqgCuzqy46q.exe8hnXvxWeZzvZ4RJFAD1R0GWj.exeDeQFayi1FpMd0IqpH017YESY.exesSFRnOcrAlH5JfAkeVy8QUwH.exepid process 4800 sePN_ed_pQIVAhbqiwAo62Gi.exe 4224 L_jpmMmtCmkp04E2BqzHCb38.exe 1744 2Hcs3_JBb4EnNxyNL7BtQoRb.exe 6188 JjZDSvbNDxAZqKXnnN92hKhL.exe 6532 EHO8lR_vjhpbFvHsoZdsIht2.exe 6308 sVd43iem2yJnbjSynxJ6INV_.exe 2408 m_dHPxV3CoK8c5hyX6vGMrzv.exe 8276 CsgUijERrsmTrbESACC5X25M.exe 8436 VM5_8Vz9RniAnjqgCuzqy46q.exe 9348 8hnXvxWeZzvZ4RJFAD1R0GWj.exe 9792 DeQFayi1FpMd0IqpH017YESY.exe 9916 sSFRnOcrAlH5JfAkeVy8QUwH.exe -
Suspicious use of SetThreadContext 41 IoCs
Processes:
svchost.exeOLKbrowser.exeDv_HhgDriI7E8LCdR1AMfCzv.exeIsJLKYUTzY9fr08H7FNU_XXs.exefindstr.exex2Ezdo1WDoaOcNFcxcdqmBxR.exeqAwAsVYs2wyfxP1hwERTSait.exesIPK633F8oHtxQ6lzprM1BOp.exeI8T1zkNsiM_caTETk47Dvn1m.exeUpdater.exeMkIjY0hUdkbyHW7E3PYhVP38.exel7uceB9wT2i0TOm6OSqk2Qly.exe1877553916.execBpNK0JqK1UxOztKt1gxZDs4.exeGfBxSJhYJ0nlVZaCFoT_rxos.exeNg3fRJnm2X35mUYb2guSldMg.exeTMoR3Agx9OoSzrfoZPLHw3r7.exe5MH65BPWKD0YNUAK.exe1138447678.exe11111.exe1070793794.exe8sO_lAP8vSeCQaBFPnom1ODg.exefSXe79Dlwztbn5unFX4e6I8w.exe5DARgpbIRZTDbMiIIXTAT6Wa.exeX0PTapaN0zRy54YuetC_oJz6.exeWaffaJ6PIVbmepD9h6ZMeqYf.exeHql4wv1t8IHrnf9kI1MhqJwr.exe451586966.exe1186056457.exe1609930404.exeszU_WMmocV7pqs98gWb1CuE2.exeqaoZoi9jzplZAUzC607QDdSO.exeFZDBaIU3LSArhyvKLPnyMo5P.exepaHacjckzhLbXaDnzNZKZ2K7.exewtMIgwpfyQtg_T4K4lY_W_JM.exeBB9OBV8FFuqpaGoG1hlsSKsY.exeTLal4CsVmj4voCio6gjv0dmd.exe663051601.exeMicrosoftEdgeCP.exeAcre.exe.comAcre.exe.comdescription pid process target process PID 2300 set thread context of 1608 2300 svchost.exe svchost.exe PID 4604 set thread context of 3088 4604 OLKbrowser.exe OLKbrowser.exe PID 4492 set thread context of 2864 4492 Dv_HhgDriI7E8LCdR1AMfCzv.exe Dv_HhgDriI7E8LCdR1AMfCzv.exe PID 4428 set thread context of 1432 4428 IsJLKYUTzY9fr08H7FNU_XXs.exe IsJLKYUTzY9fr08H7FNU_XXs.exe PID 1756 set thread context of 792 1756 findstr.exe n8u6wwQhmD5FNpX6fCXZvd7k.exe PID 4228 set thread context of 3080 4228 x2Ezdo1WDoaOcNFcxcdqmBxR.exe x2Ezdo1WDoaOcNFcxcdqmBxR.exe PID 4480 set thread context of 4628 4480 qAwAsVYs2wyfxP1hwERTSait.exe qAwAsVYs2wyfxP1hwERTSait.exe PID 3000 set thread context of 3920 3000 sIPK633F8oHtxQ6lzprM1BOp.exe sIPK633F8oHtxQ6lzprM1BOp.exe PID 5048 set thread context of 2272 5048 I8T1zkNsiM_caTETk47Dvn1m.exe I8T1zkNsiM_caTETk47Dvn1m.exe PID 4204 set thread context of 6412 4204 Updater.exe Updater.exe PID 7068 set thread context of 7224 7068 MkIjY0hUdkbyHW7E3PYhVP38.exe MkIjY0hUdkbyHW7E3PYhVP38.exe PID 6200 set thread context of 7320 6200 l7uceB9wT2i0TOm6OSqk2Qly.exe l7uceB9wT2i0TOm6OSqk2Qly.exe PID 5992 set thread context of 7652 5992 1877553916.exe 1877553916.exe PID 6388 set thread context of 7428 6388 cBpNK0JqK1UxOztKt1gxZDs4.exe cBpNK0JqK1UxOztKt1gxZDs4.exe PID 5028 set thread context of 7476 5028 GfBxSJhYJ0nlVZaCFoT_rxos.exe GfBxSJhYJ0nlVZaCFoT_rxos.exe PID 4408 set thread context of 7536 4408 Ng3fRJnm2X35mUYb2guSldMg.exe Ng3fRJnm2X35mUYb2guSldMg.exe PID 6964 set thread context of 8088 6964 TMoR3Agx9OoSzrfoZPLHw3r7.exe TMoR3Agx9OoSzrfoZPLHw3r7.exe PID 7100 set thread context of 7988 7100 5MH65BPWKD0YNUAK.exe HrrK2U03KQjYUU8YWNsy54pB.exe PID 6224 set thread context of 7396 6224 1138447678.exe 1138447678.exe PID 6092 set thread context of 8560 6092 11111.exe DiySUYwvUVsKr4fcRAG13t3F.exe PID 740 set thread context of 8700 740 1070793794.exe 1070793794.exe PID 7044 set thread context of 8628 7044 8sO_lAP8vSeCQaBFPnom1ODg.exe 8sO_lAP8vSeCQaBFPnom1ODg.exe PID 6040 set thread context of 9028 6040 fSXe79Dlwztbn5unFX4e6I8w.exe fSXe79Dlwztbn5unFX4e6I8w.exe PID 5852 set thread context of 9168 5852 5DARgpbIRZTDbMiIIXTAT6Wa.exe 5DARgpbIRZTDbMiIIXTAT6Wa.exe PID 6764 set thread context of 9200 6764 X0PTapaN0zRy54YuetC_oJz6.exe X0PTapaN0zRy54YuetC_oJz6.exe PID 3888 set thread context of 6840 3888 WaffaJ6PIVbmepD9h6ZMeqYf.exe WaffaJ6PIVbmepD9h6ZMeqYf.exe PID 8300 set thread context of 6760 8300 Hql4wv1t8IHrnf9kI1MhqJwr.exe Hql4wv1t8IHrnf9kI1MhqJwr.exe PID 7384 set thread context of 5160 7384 451586966.exe 451586966.exe PID 6400 set thread context of 9048 6400 1186056457.exe 1186056457.exe PID 4892 set thread context of 8916 4892 1609930404.exe 1609930404.exe PID 5248 set thread context of 9864 5248 szU_WMmocV7pqs98gWb1CuE2.exe szU_WMmocV7pqs98gWb1CuE2.exe PID 6652 set thread context of 9964 6652 qaoZoi9jzplZAUzC607QDdSO.exe qaoZoi9jzplZAUzC607QDdSO.exe PID 9228 set thread context of 8000 9228 FZDBaIU3LSArhyvKLPnyMo5P.exe FZDBaIU3LSArhyvKLPnyMo5P.exe PID 9388 set thread context of 6636 9388 paHacjckzhLbXaDnzNZKZ2K7.exe paHacjckzhLbXaDnzNZKZ2K7.exe PID 9840 set thread context of 9404 9840 wtMIgwpfyQtg_T4K4lY_W_JM.exe wtMIgwpfyQtg_T4K4lY_W_JM.exe PID 6152 set thread context of 8504 6152 BB9OBV8FFuqpaGoG1hlsSKsY.exe BB9OBV8FFuqpaGoG1hlsSKsY.exe PID 9804 set thread context of 1012 9804 TLal4CsVmj4voCio6gjv0dmd.exe TLal4CsVmj4voCio6gjv0dmd.exe PID 8904 set thread context of 1960 8904 663051601.exe 663051601.exe PID 9448 set thread context of 9564 9448 MicrosoftEdgeCP.exe 783588440.exe PID 6292 set thread context of 9388 6292 Acre.exe.com RegAsm.exe PID 620 set thread context of 8544 620 Acre.exe.com RegAsm.exe -
Drops file in Program Files directory 22 IoCs
Processes:
9p0AsioBkFCim_MnCBUGnU8A.exe88i1Jl51hkvYDb6F6KBsdkaa.execmd.exenMgQw74IH0jEYMPGSpMBBE0J.exedescription ioc process File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat 9p0AsioBkFCim_MnCBUGnU8A.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe 88i1Jl51hkvYDb6F6KBsdkaa.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg cmd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg cmd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe nMgQw74IH0jEYMPGSpMBBE0J.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg nMgQw74IH0jEYMPGSpMBBE0J.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat nMgQw74IH0jEYMPGSpMBBE0J.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg 9p0AsioBkFCim_MnCBUGnU8A.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe 9p0AsioBkFCim_MnCBUGnU8A.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg 88i1Jl51hkvYDb6F6KBsdkaa.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe cmd.exe File created C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini cmd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe nMgQw74IH0jEYMPGSpMBBE0J.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg 88i1Jl51hkvYDb6F6KBsdkaa.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat 88i1Jl51hkvYDb6F6KBsdkaa.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe 88i1Jl51hkvYDb6F6KBsdkaa.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat cmd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe cmd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe 9p0AsioBkFCim_MnCBUGnU8A.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe cmd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg nMgQw74IH0jEYMPGSpMBBE0J.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg 9p0AsioBkFCim_MnCBUGnU8A.exe -
Drops file in Windows directory 7 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exesetup 326.exeWerFault.exeMicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\winnetdriv.exe setup 326.exe File opened for modification C:\Windows\winnetdriv.exe setup 326.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4388 3096 WerFault.exe sonia_3.exe 3672 4136 WerFault.exe Chrome Update.exe 4620 4932 WerFault.exe setup.exe 4684 4932 WerFault.exe setup.exe 2688 4932 WerFault.exe setup.exe 740 5068 WerFault.exe gcN4vjRaRQ09r0mmKWbHNSmo.exe 1464 4932 WerFault.exe setup.exe 5256 4932 WerFault.exe setup.exe 5248 5068 WerFault.exe gcN4vjRaRQ09r0mmKWbHNSmo.exe 5576 5068 WerFault.exe gcN4vjRaRQ09r0mmKWbHNSmo.exe 5816 5068 WerFault.exe gcN4vjRaRQ09r0mmKWbHNSmo.exe 4160 4932 WerFault.exe setup.exe 3684 4932 WerFault.exe setup.exe 5232 5068 WerFault.exe gcN4vjRaRQ09r0mmKWbHNSmo.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
csfvcutsonia_2.execsfvcutcsfvcutdescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI csfvcut -
Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Hql4wv1t8IHrnf9kI1MhqJwr.exeWaffaJ6PIVbmepD9h6ZMeqYf.exe4486494.exeTMoR3Agx9OoSzrfoZPLHw3r7.exe0DPbuhMgwwCQ3N8r_cWCgnLC.exesvchost.exesvchost.exetimeout.exeHrrK2U03KQjYUU8YWNsy54pB.exeBB9OBV8FFuqpaGoG1hlsSKsY.exeTLal4CsVmj4voCio6gjv0dmd.exeI8T1zkNsiM_caTETk47Dvn1m.exeqAwAsVYs2wyfxP1hwERTSait.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Hql4wv1t8IHrnf9kI1MhqJwr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WaffaJ6PIVbmepD9h6ZMeqYf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4486494.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TMoR3Agx9OoSzrfoZPLHw3r7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Hql4wv1t8IHrnf9kI1MhqJwr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0DPbuhMgwwCQ3N8r_cWCgnLC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0DPbuhMgwwCQ3N8r_cWCgnLC.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString timeout.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 HrrK2U03KQjYUU8YWNsy54pB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString HrrK2U03KQjYUU8YWNsy54pB.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BB9OBV8FFuqpaGoG1hlsSKsY.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BB9OBV8FFuqpaGoG1hlsSKsY.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TLal4CsVmj4voCio6gjv0dmd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 I8T1zkNsiM_caTETk47Dvn1m.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 qAwAsVYs2wyfxP1hwERTSait.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TMoR3Agx9OoSzrfoZPLHw3r7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString TLal4CsVmj4voCio6gjv0dmd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4486494.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 timeout.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 WaffaJ6PIVbmepD9h6ZMeqYf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString I8T1zkNsiM_caTETk47Dvn1m.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString qAwAsVYs2wyfxP1hwERTSait.exe -
Delays execution with timeout.exe 8 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1436 timeout.exe 5676 timeout.exe 10136 timeout.exe 6992 timeout.exe 8536 timeout.exe 7300 timeout.exe 9568 timeout.exe 4052 timeout.exe -
Kills process with taskkill 8 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 10032 taskkill.exe 7276 taskkill.exe 6288 taskkill.exe 7024 taskkill.exe 8072 taskkill.exe 6084 taskkill.exe 6656 taskkill.exe 6668 taskkill.exe -
Processes:
MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exebrowser_broker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
vyoyD3NZn6Pqk13vHQw_Ts41.exely60ll32L_bDjXxDUQk8yzy6.exeo6tyyvv7EPRdJIGDuT6jagBr.exeG7dAGg_eGgIHhLv_Brh_9sUS.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs o6tyyvv7EPRdJIGDuT6jagBr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates o6tyyvv7EPRdJIGDuT6jagBr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 G7dAGg_eGgIHhLv_Brh_9sUS.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs G7dAGg_eGgIHhLv_Brh_9sUS.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust ly60ll32L_bDjXxDUQk8yzy6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" ly60ll32L_bDjXxDUQk8yzy6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" o6tyyvv7EPRdJIGDuT6jagBr.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" vyoyD3NZn6Pqk13vHQw_Ts41.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" G7dAGg_eGgIHhLv_Brh_9sUS.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" o6tyyvv7EPRdJIGDuT6jagBr.exe -
Modifies registry class 64 IoCs
Processes:
x2Ezdo1WDoaOcNFcxcdqmBxR.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdge.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K} x2Ezdo1WDoaOcNFcxcdqmBxR.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ad256e18ed7cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 3fd9e606ed7cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedHeight = "600" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M} x2Ezdo1WDoaOcNFcxcdqmBxR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M} rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{C240CA15-6779-428A-B6DE-EE2CD9B58B90}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 301bd569d72dd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 301bd569d72dd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6f7bf1fdec7cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{593AEFC8-9638-4345-B974-3FF90B647F8A} = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe -
Processes:
sonia_3.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe -
NTFS ADS 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\ProgramData\5MH65BPWKD0YNUAK.exe:Zone.Identifier svchost.exe File opened for modification C:\ProgramData\5MH65BPWKD0YNUAK.exe:Zone.Identifier svchost.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 5564 regedit.exe 6196 regedit.exe -
Runs ping.exe 1 TTPs 8 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 7776 PING.EXE 8800 PING.EXE 10068 PING.EXE 9764 PING.EXE 9800 PING.EXE 5464 PING.EXE 6568 PING.EXE 6712 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
sonia_2.exex2Ezdo1WDoaOcNFcxcdqmBxR.exesvchost.exejfiag3g_gg.exepid process 3104 sonia_2.exe 3104 sonia_2.exe 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe 2300 svchost.exe 2300 svchost.exe 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 4320 jfiag3g_gg.exe 4320 jfiag3g_gg.exe 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 2764 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2764 -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
sonia_2.execsfvcutAcre.exe.comAcre.exe.comcsfvcutcsfvcutpid process 3104 sonia_2.exe 6436 csfvcut 620 Acre.exe.com 6292 Acre.exe.com 620 Acre.exe.com 5580 csfvcut 8988 csfvcut -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
sonia_4.exex2Ezdo1WDoaOcNFcxcdqmBxR.exesvchost.exesvchost.exedescription pid process Token: SeDebugPrivilege 2128 sonia_4.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 2300 svchost.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeDebugPrivilege 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe Token: SeShutdownPrivilege 2764 Token: SeCreatePagefilePrivilege 2764 Token: SeShutdownPrivilege 2764 Token: SeCreatePagefilePrivilege 2764 Token: SeShutdownPrivilege 2764 Token: SeCreatePagefilePrivilege 2764 Token: SeShutdownPrivilege 2764 Token: SeCreatePagefilePrivilege 2764 Token: SeAssignPrimaryTokenPrivilege 2624 svchost.exe Token: SeIncreaseQuotaPrivilege 2624 svchost.exe Token: SeSecurityPrivilege 2624 svchost.exe Token: SeTakeOwnershipPrivilege 2624 svchost.exe Token: SeLoadDriverPrivilege 2624 svchost.exe Token: SeSystemtimePrivilege 2624 svchost.exe Token: SeBackupPrivilege 2624 svchost.exe Token: SeRestorePrivilege 2624 svchost.exe Token: SeShutdownPrivilege 2624 svchost.exe Token: SeSystemEnvironmentPrivilege 2624 svchost.exe Token: SeUndockPrivilege 2624 svchost.exe Token: SeManageVolumePrivilege 2624 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2624 svchost.exe Token: SeIncreaseQuotaPrivilege 2624 svchost.exe Token: SeSecurityPrivilege 2624 svchost.exe Token: SeTakeOwnershipPrivilege 2624 svchost.exe Token: SeLoadDriverPrivilege 2624 svchost.exe Token: SeSystemtimePrivilege 2624 svchost.exe Token: SeBackupPrivilege 2624 svchost.exe Token: SeRestorePrivilege 2624 svchost.exe Token: SeShutdownPrivilege 2624 svchost.exe Token: SeSystemEnvironmentPrivilege 2624 svchost.exe Token: SeUndockPrivilege 2624 svchost.exe Token: SeManageVolumePrivilege 2624 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2624 svchost.exe Token: SeIncreaseQuotaPrivilege 2624 svchost.exe Token: SeSecurityPrivilege 2624 svchost.exe Token: SeTakeOwnershipPrivilege 2624 svchost.exe Token: SeLoadDriverPrivilege 2624 svchost.exe Token: SeSystemtimePrivilege 2624 svchost.exe Token: SeBackupPrivilege 2624 svchost.exe Token: SeRestorePrivilege 2624 svchost.exe Token: SeShutdownPrivilege 2624 svchost.exe Token: SeSystemEnvironmentPrivilege 2624 svchost.exe Token: SeUndockPrivilege 2624 svchost.exe Token: SeManageVolumePrivilege 2624 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2624 svchost.exe Token: SeIncreaseQuotaPrivilege 2624 svchost.exe Token: SeSecurityPrivilege 2624 svchost.exe Token: SeTakeOwnershipPrivilege 2624 svchost.exe Token: SeLoadDriverPrivilege 2624 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 2764 2764 -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 2764 5384 MicrosoftEdge.exe 3972 MicrosoftEdgeCP.exe 3972 MicrosoftEdgeCP.exe 2156 MicrosoftEdge.exe 9000 MicrosoftEdge.exe 8524 MicrosoftEdge.exe 6960 MicrosoftEdgeCP.exe 6960 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 2764 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8 (16).exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_1.exesonia_6.exeOLKbrowser.exex2Ezdo1WDoaOcNFcxcdqmBxR.exesvchost.exesonia_4.exedescription pid process target process PID 3400 wrote to memory of 2200 3400 8 (16).exe setup_installer.exe PID 3400 wrote to memory of 2200 3400 8 (16).exe setup_installer.exe PID 3400 wrote to memory of 2200 3400 8 (16).exe setup_installer.exe PID 2200 wrote to memory of 3616 2200 setup_installer.exe setup_install.exe PID 2200 wrote to memory of 3616 2200 setup_installer.exe setup_install.exe PID 2200 wrote to memory of 3616 2200 setup_installer.exe setup_install.exe PID 3616 wrote to memory of 3424 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3424 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3424 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 4020 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 4020 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 4020 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3632 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3632 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3632 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3456 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3456 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3456 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3464 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3464 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3464 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3996 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3996 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3996 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3748 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3748 3616 setup_install.exe cmd.exe PID 3616 wrote to memory of 3748 3616 setup_install.exe cmd.exe PID 3424 wrote to memory of 1140 3424 cmd.exe sonia_1.exe PID 3424 wrote to memory of 1140 3424 cmd.exe sonia_1.exe PID 3424 wrote to memory of 1140 3424 cmd.exe sonia_1.exe PID 4020 wrote to memory of 3104 4020 cmd.exe sonia_2.exe PID 4020 wrote to memory of 3104 4020 cmd.exe sonia_2.exe PID 4020 wrote to memory of 3104 4020 cmd.exe sonia_2.exe PID 3456 wrote to memory of 2128 3456 cmd.exe sonia_4.exe PID 3456 wrote to memory of 2128 3456 cmd.exe sonia_4.exe PID 3632 wrote to memory of 3096 3632 cmd.exe sonia_3.exe PID 3632 wrote to memory of 3096 3632 cmd.exe sonia_3.exe PID 3632 wrote to memory of 3096 3632 cmd.exe sonia_3.exe PID 3464 wrote to memory of 2152 3464 cmd.exe sonia_5.exe PID 3464 wrote to memory of 2152 3464 cmd.exe sonia_5.exe PID 3464 wrote to memory of 2152 3464 cmd.exe sonia_5.exe PID 3996 wrote to memory of 1676 3996 cmd.exe sonia_6.exe PID 3996 wrote to memory of 1676 3996 cmd.exe sonia_6.exe PID 3996 wrote to memory of 1676 3996 cmd.exe sonia_6.exe PID 1140 wrote to memory of 4040 1140 sonia_1.exe sonia_1.exe PID 1140 wrote to memory of 4040 1140 sonia_1.exe sonia_1.exe PID 1140 wrote to memory of 4040 1140 sonia_1.exe sonia_1.exe PID 1676 wrote to memory of 1908 1676 sonia_6.exe jfiag3g_gg.exe PID 1676 wrote to memory of 1908 1676 sonia_6.exe jfiag3g_gg.exe PID 1676 wrote to memory of 1908 1676 sonia_6.exe jfiag3g_gg.exe PID 3088 wrote to memory of 3080 3088 OLKbrowser.exe x2Ezdo1WDoaOcNFcxcdqmBxR.exe PID 3088 wrote to memory of 3080 3088 OLKbrowser.exe x2Ezdo1WDoaOcNFcxcdqmBxR.exe PID 3088 wrote to memory of 3080 3088 OLKbrowser.exe x2Ezdo1WDoaOcNFcxcdqmBxR.exe PID 3080 wrote to memory of 2300 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe svchost.exe PID 3080 wrote to memory of 2536 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe svchost.exe PID 2300 wrote to memory of 1608 2300 svchost.exe svchost.exe PID 2300 wrote to memory of 1608 2300 svchost.exe svchost.exe PID 2300 wrote to memory of 1608 2300 svchost.exe svchost.exe PID 2128 wrote to memory of 2344 2128 sonia_4.exe LzmwAqmV.exe PID 2128 wrote to memory of 2344 2128 sonia_4.exe LzmwAqmV.exe PID 2128 wrote to memory of 2344 2128 sonia_4.exe LzmwAqmV.exe PID 3080 wrote to memory of 1008 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe svchost.exe PID 3080 wrote to memory of 2376 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe svchost.exe PID 3080 wrote to memory of 2336 3080 x2Ezdo1WDoaOcNFcxcdqmBxR.exe svchost.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\csfvcutC:\Users\Admin\AppData\Roaming\csfvcut2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\csfvcutC:\Users\Admin\AppData\Roaming\csfvcut2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\csfvcutC:\Users\Admin\AppData\Roaming\csfvcut2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\8 (16).exe"C:\Users\Admin\AppData\Local\Temp\8 (16).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS89819B14\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeC:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeC:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup 326.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626733425 08⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 8128⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 8448⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 8888⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 9648⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 9688⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 9888⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 10488⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4136 -s 10048⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\IsJLKYUTzY9fr08H7FNU_XXs.exe"C:\Users\Admin\Documents\IsJLKYUTzY9fr08H7FNU_XXs.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\IsJLKYUTzY9fr08H7FNU_XXs.exeC:\Users\Admin\Documents\IsJLKYUTzY9fr08H7FNU_XXs.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\x2Ezdo1WDoaOcNFcxcdqmBxR.exe"C:\Users\Admin\Documents\x2Ezdo1WDoaOcNFcxcdqmBxR.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\x2Ezdo1WDoaOcNFcxcdqmBxR.exeC:\Users\Admin\Documents\x2Ezdo1WDoaOcNFcxcdqmBxR.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\x2Ezdo1WDoaOcNFcxcdqmBxR.exeC:\Users\Admin\Documents\x2Ezdo1WDoaOcNFcxcdqmBxR.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\o1wtY_90NH4nzz8Y3jQFRETc.exe"C:\Users\Admin\Documents\o1wtY_90NH4nzz8Y3jQFRETc.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\7280200.exe"C:\Users\Admin\AppData\Roaming\7280200.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\2237588.exe"C:\Users\Admin\AppData\Roaming\2237588.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Dv_HhgDriI7E8LCdR1AMfCzv.exe"C:\Users\Admin\Documents\Dv_HhgDriI7E8LCdR1AMfCzv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Dv_HhgDriI7E8LCdR1AMfCzv.exeC:\Users\Admin\Documents\Dv_HhgDriI7E8LCdR1AMfCzv.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\_5ESty5sWL_a7y2OwqlBufqt.exe"C:\Users\Admin\Documents\_5ESty5sWL_a7y2OwqlBufqt.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\n8u6wwQhmD5FNpX6fCXZvd7k.exe"C:\Users\Admin\Documents\n8u6wwQhmD5FNpX6fCXZvd7k.exe"6⤵
-
C:\Users\Admin\Documents\n8u6wwQhmD5FNpX6fCXZvd7k.exeC:\Users\Admin\Documents\n8u6wwQhmD5FNpX6fCXZvd7k.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\RQWaG8v7LSBzi8KXMTOHvKxz.exe"C:\Users\Admin\Documents\RQWaG8v7LSBzi8KXMTOHvKxz.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "7⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer https://iplogger.org/2LBCU68⤵
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj.reg8⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj2.reg8⤵
- Runs .reg file with regedit
-
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"8⤵
-
C:\Users\Admin\Documents\O2HBLFHTLSJK5EEyQvzwv1o6.exe"C:\Users\Admin\Documents\O2HBLFHTLSJK5EEyQvzwv1o6.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\Documents\sePN_ed_pQIVAhbqiwAo62Gi.exe"C:\Users\Admin\Documents\sePN_ed_pQIVAhbqiwAo62Gi.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\qAwAsVYs2wyfxP1hwERTSait.exe"C:\Users\Admin\Documents\qAwAsVYs2wyfxP1hwERTSait.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\qAwAsVYs2wyfxP1hwERTSait.exeC:\Users\Admin\Documents\qAwAsVYs2wyfxP1hwERTSait.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im qAwAsVYs2wyfxP1hwERTSait.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\qAwAsVYs2wyfxP1hwERTSait.exe" & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im qAwAsVYs2wyfxP1hwERTSait.exe /f9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\qAwAsVYs2wyfxP1hwERTSait.exeC:\Users\Admin\Documents\qAwAsVYs2wyfxP1hwERTSait.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\0T_CfNP7TR6rGwMHJJIlVryI.exe"C:\Users\Admin\Documents\0T_CfNP7TR6rGwMHJJIlVryI.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1877553916.exeC:\Users\Admin\AppData\Local\Temp\1877553916.exe7⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1877553916.exeC:\Users\Admin\AppData\Local\Temp\1877553916.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\1138447678.exeC:\Users\Admin\AppData\Local\Temp\1138447678.exe7⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1138447678.exeC:\Users\Admin\AppData\Local\Temp\1138447678.exe8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\0T_CfNP7TR6rGwMHJJIlVryI.exe & exit7⤵
-
C:\Windows\SysWOW64\PING.EXEping 08⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\OXjOeGlru723sf_BuDje2WXH.exe"C:\Users\Admin\Documents\OXjOeGlru723sf_BuDje2WXH.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comAcre.exe.com k9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k10⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k11⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k12⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k13⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k15⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k16⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k17⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k18⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k20⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k21⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k22⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k23⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k24⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k25⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k26⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\5IfLJeK1GHHaHD5LcZVq3Nfx.exe"C:\Users\Admin\Documents\5IfLJeK1GHHaHD5LcZVq3Nfx.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5IfLJeK1GHHaHD5LcZVq3Nfx.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\5IfLJeK1GHHaHD5LcZVq3Nfx.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5IfLJeK1GHHaHD5LcZVq3Nfx.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\2Hcs3_JBb4EnNxyNL7BtQoRb.exe"C:\Users\Admin\Documents\2Hcs3_JBb4EnNxyNL7BtQoRb.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\I8T1zkNsiM_caTETk47Dvn1m.exe"C:\Users\Admin\Documents\I8T1zkNsiM_caTETk47Dvn1m.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\I8T1zkNsiM_caTETk47Dvn1m.exe"C:\Users\Admin\Documents\I8T1zkNsiM_caTETk47Dvn1m.exe"7⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\Documents\Av4kbwzXK8TNAii39Sv4jb0Y.exe"C:\Users\Admin\Documents\Av4kbwzXK8TNAii39Sv4jb0Y.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\Documents\L_jpmMmtCmkp04E2BqzHCb38.exe"C:\Users\Admin\Documents\L_jpmMmtCmkp04E2BqzHCb38.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\o6tyyvv7EPRdJIGDuT6jagBr.exe"C:\Users\Admin\Documents\o6tyyvv7EPRdJIGDuT6jagBr.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\o6tyyvv7EPRdJIGDuT6jagBr.exe"C:\Users\Admin\Documents\o6tyyvv7EPRdJIGDuT6jagBr.exe"7⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\sIPK633F8oHtxQ6lzprM1BOp.exe"C:\Users\Admin\Documents\sIPK633F8oHtxQ6lzprM1BOp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\sIPK633F8oHtxQ6lzprM1BOp.exeC:\Users\Admin\Documents\sIPK633F8oHtxQ6lzprM1BOp.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\sIPK633F8oHtxQ6lzprM1BOp.exeC:\Users\Admin\Documents\sIPK633F8oHtxQ6lzprM1BOp.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\QO8lSQzThBPlzP5OHIQ5dmMH.exe"C:\Users\Admin\Documents\QO8lSQzThBPlzP5OHIQ5dmMH.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS020E9E95\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS020E9E95\setup_install.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_2.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS020E9E95\karotima_2.exekarotima_2.exe10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS020E9E95\karotima_2.exe"C:\Users\Admin\AppData\Local\Temp\7zS020E9E95\karotima_2.exe" -a11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_1.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS020E9E95\karotima_1.exekarotima_1.exe10⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\nMgQw74IH0jEYMPGSpMBBE0J.exe"C:\Users\Admin\Documents\nMgQw74IH0jEYMPGSpMBBE0J.exe"11⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\MJMY2CbpNaGaLTRV8afucMlo.exe"C:\Users\Admin\Documents\MJMY2CbpNaGaLTRV8afucMlo.exe"11⤵
-
C:\Users\Admin\Documents\TMoR3Agx9OoSzrfoZPLHw3r7.exe"C:\Users\Admin\Documents\TMoR3Agx9OoSzrfoZPLHw3r7.exe"11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\TMoR3Agx9OoSzrfoZPLHw3r7.exe"C:\Users\Admin\Documents\TMoR3Agx9OoSzrfoZPLHw3r7.exe"12⤵
- Checks processor information in registry
-
C:\Users\Admin\Documents\5a4zuvevGlgkR_NRKllvvr5T.exe"C:\Users\Admin\Documents\5a4zuvevGlgkR_NRKllvvr5T.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\2487486.exe"C:\Users\Admin\AppData\Roaming\2487486.exe"12⤵
-
C:\Users\Admin\AppData\Roaming\5078368.exe"C:\Users\Admin\AppData\Roaming\5078368.exe"12⤵
-
C:\Users\Admin\Documents\tFawvs1d35yKsDtcYtC2S8mt.exe"C:\Users\Admin\Documents\tFawvs1d35yKsDtcYtC2S8mt.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4CF38106\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4CF38106\setup_install.exe"13⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_2.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4CF38106\karotima_2.exekarotima_2.exe15⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4CF38106\karotima_2.exe"C:\Users\Admin\AppData\Local\Temp\7zS4CF38106\karotima_2.exe" -a16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_1.exe14⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4CF38106\karotima_1.exekarotima_1.exe15⤵
- Checks computer location settings
-
C:\Users\Admin\Documents\UZxWMQK11pDzpZ2RopxNwpZX.exe"C:\Users\Admin\Documents\UZxWMQK11pDzpZ2RopxNwpZX.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp17⤵
-
C:\Windows\SysWOW64\cmd.execmd18⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comAcre.exe.com k19⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com k20⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com k21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com k22⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com k23⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com k24⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com k25⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com k26⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\RegAsm.exe27⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 3019⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\m_dHPxV3CoK8c5hyX6vGMrzv.exe"C:\Users\Admin\Documents\m_dHPxV3CoK8c5hyX6vGMrzv.exe"16⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\fSXe79Dlwztbn5unFX4e6I8w.exe"C:\Users\Admin\Documents\fSXe79Dlwztbn5unFX4e6I8w.exe"16⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\fSXe79Dlwztbn5unFX4e6I8w.exeC:\Users\Admin\Documents\fSXe79Dlwztbn5unFX4e6I8w.exe17⤵
-
C:\Users\Admin\Documents\WaffaJ6PIVbmepD9h6ZMeqYf.exe"C:\Users\Admin\Documents\WaffaJ6PIVbmepD9h6ZMeqYf.exe"16⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\WaffaJ6PIVbmepD9h6ZMeqYf.exeC:\Users\Admin\Documents\WaffaJ6PIVbmepD9h6ZMeqYf.exe17⤵
-
C:\Users\Admin\Documents\WaffaJ6PIVbmepD9h6ZMeqYf.exeC:\Users\Admin\Documents\WaffaJ6PIVbmepD9h6ZMeqYf.exe17⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im WaffaJ6PIVbmepD9h6ZMeqYf.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\WaffaJ6PIVbmepD9h6ZMeqYf.exe" & del C:\ProgramData\*.dll & exit18⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im WaffaJ6PIVbmepD9h6ZMeqYf.exe /f19⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 619⤵
- Loads dropped DLL
- Checks processor information in registry
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\X0PTapaN0zRy54YuetC_oJz6.exe"C:\Users\Admin\Documents\X0PTapaN0zRy54YuetC_oJz6.exe"16⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\X0PTapaN0zRy54YuetC_oJz6.exeC:\Users\Admin\Documents\X0PTapaN0zRy54YuetC_oJz6.exe17⤵
-
C:\Users\Admin\Documents\X0PTapaN0zRy54YuetC_oJz6.exeC:\Users\Admin\Documents\X0PTapaN0zRy54YuetC_oJz6.exe17⤵
-
C:\Users\Admin\Documents\CtcVCkIdybY2E1XRk0aGHQIL.exe"C:\Users\Admin\Documents\CtcVCkIdybY2E1XRk0aGHQIL.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Users\Admin\Documents\9p0AsioBkFCim_MnCBUGnU8A.exe"C:\Users\Admin\Documents\9p0AsioBkFCim_MnCBUGnU8A.exe"16⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\Gp3dAZfPfqAEWlwXW__jn8bE.exe"C:\Users\Admin\Documents\Gp3dAZfPfqAEWlwXW__jn8bE.exe"16⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\1186056457.exeC:\Users\Admin\AppData\Local\Temp\1186056457.exe17⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1186056457.exeC:\Users\Admin\AppData\Local\Temp\1186056457.exe18⤵
-
C:\Users\Admin\AppData\Local\Temp\1609930404.exeC:\Users\Admin\AppData\Local\Temp\1609930404.exe17⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1609930404.exeC:\Users\Admin\AppData\Local\Temp\1609930404.exe18⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\Gp3dAZfPfqAEWlwXW__jn8bE.exe & exit17⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
-
C:\Windows\SysWOW64\PING.EXEping 018⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\O63tjTPfISmj6C4cOoPg6Wsf.exe"C:\Users\Admin\Documents\O63tjTPfISmj6C4cOoPg6Wsf.exe"16⤵
-
C:\Users\Admin\Documents\5DARgpbIRZTDbMiIIXTAT6Wa.exe"C:\Users\Admin\Documents\5DARgpbIRZTDbMiIIXTAT6Wa.exe"16⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\5DARgpbIRZTDbMiIIXTAT6Wa.exeC:\Users\Admin\Documents\5DARgpbIRZTDbMiIIXTAT6Wa.exe17⤵
-
C:\Users\Admin\Documents\fiFjS1B3O9p1cMjegJrRD74B.exe"C:\Users\Admin\Documents\fiFjS1B3O9p1cMjegJrRD74B.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8E2FEEC7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8E2FEEC7\setup_install.exe"18⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_2.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8E2FEEC7\karotima_2.exekarotima_2.exe20⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8E2FEEC7\karotima_2.exe"C:\Users\Admin\AppData\Local\Temp\7zS8E2FEEC7\karotima_2.exe" -a21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_1.exe19⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8E2FEEC7\karotima_1.exekarotima_1.exe20⤵
-
C:\Users\Admin\Documents\jr8ZVY2LXdTXw0TRLYV7kZJ_.exe"C:\Users\Admin\Documents\jr8ZVY2LXdTXw0TRLYV7kZJ_.exe"21⤵
-
C:\Users\Admin\Documents\LrzudBeTva_MGwk1c7fGlAqF.exe"C:\Users\Admin\Documents\LrzudBeTva_MGwk1c7fGlAqF.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp22⤵
-
C:\Windows\SysWOW64\cmd.execmd23⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp24⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\Acre.exe.comAcre.exe.com k24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\RegAsm.exe25⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\RegAsm.exe25⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 3024⤵
- Executes dropped EXE
- Runs ping.exe
-
C:\Users\Admin\Documents\szU_WMmocV7pqs98gWb1CuE2.exe"C:\Users\Admin\Documents\szU_WMmocV7pqs98gWb1CuE2.exe"21⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\szU_WMmocV7pqs98gWb1CuE2.exeC:\Users\Admin\Documents\szU_WMmocV7pqs98gWb1CuE2.exe22⤵
-
C:\Users\Admin\Documents\qaoZoi9jzplZAUzC607QDdSO.exe"C:\Users\Admin\Documents\qaoZoi9jzplZAUzC607QDdSO.exe"21⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\qaoZoi9jzplZAUzC607QDdSO.exeC:\Users\Admin\Documents\qaoZoi9jzplZAUzC607QDdSO.exe22⤵
-
C:\Users\Admin\Documents\gBfxCjqBI_tsK4MrS0IfDIuY.exe"C:\Users\Admin\Documents\gBfxCjqBI_tsK4MrS0IfDIuY.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt22⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt22⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt22⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt22⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt22⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt22⤵
-
C:\Users\Admin\Documents\BB9OBV8FFuqpaGoG1hlsSKsY.exe"C:\Users\Admin\Documents\BB9OBV8FFuqpaGoG1hlsSKsY.exe"21⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\BB9OBV8FFuqpaGoG1hlsSKsY.exeC:\Users\Admin\Documents\BB9OBV8FFuqpaGoG1hlsSKsY.exe22⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im BB9OBV8FFuqpaGoG1hlsSKsY.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\BB9OBV8FFuqpaGoG1hlsSKsY.exe" & del C:\ProgramData\*.dll & exit23⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im BB9OBV8FFuqpaGoG1hlsSKsY.exe /f24⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 624⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\88i1Jl51hkvYDb6F6KBsdkaa.exe"C:\Users\Admin\Documents\88i1Jl51hkvYDb6F6KBsdkaa.exe"21⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\4jHvTtRx29oRnFbcl5BYLC4l.exe"C:\Users\Admin\Documents\4jHvTtRx29oRnFbcl5BYLC4l.exe"21⤵
-
C:\Users\Admin\AppData\Roaming\4486494.exe"C:\Users\Admin\AppData\Roaming\4486494.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Roaming\6161961.exe"C:\Users\Admin\AppData\Roaming\6161961.exe"22⤵
-
C:\Users\Admin\Documents\ApgLkrLaPR0Rzq_3wl5r2_Vz.exe"C:\Users\Admin\Documents\ApgLkrLaPR0Rzq_3wl5r2_Vz.exe"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\663051601.exeC:\Users\Admin\AppData\Local\Temp\663051601.exe22⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\663051601.exeC:\Users\Admin\AppData\Local\Temp\663051601.exe23⤵
-
C:\Users\Admin\AppData\Local\Temp\783588440.exeC:\Users\Admin\AppData\Local\Temp\783588440.exe22⤵
-
C:\Users\Admin\AppData\Local\Temp\783588440.exeC:\Users\Admin\AppData\Local\Temp\783588440.exe23⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\ApgLkrLaPR0Rzq_3wl5r2_Vz.exe & exit22⤵
-
C:\Windows\SysWOW64\PING.EXEping 023⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\Wi1lHwU_CuxFHUx6Vk1m922k.exe"C:\Users\Admin\Documents\Wi1lHwU_CuxFHUx6Vk1m922k.exe"21⤵
-
C:\Users\Admin\Documents\FZDBaIU3LSArhyvKLPnyMo5P.exe"C:\Users\Admin\Documents\FZDBaIU3LSArhyvKLPnyMo5P.exe"21⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\FZDBaIU3LSArhyvKLPnyMo5P.exeC:\Users\Admin\Documents\FZDBaIU3LSArhyvKLPnyMo5P.exe22⤵
-
C:\Users\Admin\Documents\xZ5NxIOO5siq3bfi1oh4AWGW.exe"C:\Users\Admin\Documents\xZ5NxIOO5siq3bfi1oh4AWGW.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS09730868\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS09730868\setup_install.exe"23⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_2.exe24⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_1.exe24⤵
-
C:\Users\Admin\Documents\8hnXvxWeZzvZ4RJFAD1R0GWj.exe"C:\Users\Admin\Documents\8hnXvxWeZzvZ4RJFAD1R0GWj.exe"21⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\paHacjckzhLbXaDnzNZKZ2K7.exe"C:\Users\Admin\Documents\paHacjckzhLbXaDnzNZKZ2K7.exe"21⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\paHacjckzhLbXaDnzNZKZ2K7.exeC:\Users\Admin\Documents\paHacjckzhLbXaDnzNZKZ2K7.exe22⤵
-
C:\Users\Admin\Documents\DeQFayi1FpMd0IqpH017YESY.exe"C:\Users\Admin\Documents\DeQFayi1FpMd0IqpH017YESY.exe"21⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\TLal4CsVmj4voCio6gjv0dmd.exe"C:\Users\Admin\Documents\TLal4CsVmj4voCio6gjv0dmd.exe"21⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\TLal4CsVmj4voCio6gjv0dmd.exe"C:\Users\Admin\Documents\TLal4CsVmj4voCio6gjv0dmd.exe"22⤵
- Checks processor information in registry
-
C:\Users\Admin\Documents\wtMIgwpfyQtg_T4K4lY_W_JM.exe"C:\Users\Admin\Documents\wtMIgwpfyQtg_T4K4lY_W_JM.exe"21⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\wtMIgwpfyQtg_T4K4lY_W_JM.exeC:\Users\Admin\Documents\wtMIgwpfyQtg_T4K4lY_W_JM.exe22⤵
-
C:\Users\Admin\Documents\wtMIgwpfyQtg_T4K4lY_W_JM.exeC:\Users\Admin\Documents\wtMIgwpfyQtg_T4K4lY_W_JM.exe22⤵
-
C:\Users\Admin\Documents\sSFRnOcrAlH5JfAkeVy8QUwH.exe"C:\Users\Admin\Documents\sSFRnOcrAlH5JfAkeVy8QUwH.exe"21⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\T2zK5Cpq66euMBR5kGcRuCFV.exe"C:\Users\Admin\Documents\T2zK5Cpq66euMBR5kGcRuCFV.exe"21⤵
-
C:\Users\Admin\Documents\G7dAGg_eGgIHhLv_Brh_9sUS.exe"C:\Users\Admin\Documents\G7dAGg_eGgIHhLv_Brh_9sUS.exe"21⤵
-
C:\Users\Admin\Documents\G7dAGg_eGgIHhLv_Brh_9sUS.exe"C:\Users\Admin\Documents\G7dAGg_eGgIHhLv_Brh_9sUS.exe"22⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\Ju5fMq_xUvPNzfkTGZQLheLd.exe"C:\Users\Admin\Documents\Ju5fMq_xUvPNzfkTGZQLheLd.exe"21⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\Documents\CTKHaWUVtk1j5iC_AadVZqwn.exe"C:\Users\Admin\Documents\CTKHaWUVtk1j5iC_AadVZqwn.exe"21⤵
-
C:\Users\Admin\Documents\CTKHaWUVtk1j5iC_AadVZqwn.exe"C:\Users\Admin\Documents\CTKHaWUVtk1j5iC_AadVZqwn.exe" -a22⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV123⤵
-
C:\Users\Admin\Documents\b3NpgQT7wMSTloPwCoipnqKj.exe"C:\Users\Admin\Documents\b3NpgQT7wMSTloPwCoipnqKj.exe"16⤵
-
C:\Users\Admin\AppData\Roaming\1398762.exe"C:\Users\Admin\AppData\Roaming\1398762.exe"17⤵
-
C:\Users\Admin\AppData\Roaming\5891838.exe"C:\Users\Admin\AppData\Roaming\5891838.exe"17⤵
-
C:\Users\Admin\Documents\8sO_lAP8vSeCQaBFPnom1ODg.exe"C:\Users\Admin\Documents\8sO_lAP8vSeCQaBFPnom1ODg.exe"16⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\8sO_lAP8vSeCQaBFPnom1ODg.exeC:\Users\Admin\Documents\8sO_lAP8vSeCQaBFPnom1ODg.exe17⤵
-
C:\Users\Admin\Documents\DiySUYwvUVsKr4fcRAG13t3F.exe"C:\Users\Admin\Documents\DiySUYwvUVsKr4fcRAG13t3F.exe"16⤵
-
C:\Users\Admin\Documents\DiySUYwvUVsKr4fcRAG13t3F.exeC:\Users\Admin\Documents\DiySUYwvUVsKr4fcRAG13t3F.exe17⤵
-
C:\Users\Admin\Documents\Hql4wv1t8IHrnf9kI1MhqJwr.exe"C:\Users\Admin\Documents\Hql4wv1t8IHrnf9kI1MhqJwr.exe"16⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Hql4wv1t8IHrnf9kI1MhqJwr.exe"C:\Users\Admin\Documents\Hql4wv1t8IHrnf9kI1MhqJwr.exe"17⤵
- Checks processor information in registry
-
C:\Users\Admin\Documents\CsgUijERrsmTrbESACC5X25M.exe"C:\Users\Admin\Documents\CsgUijERrsmTrbESACC5X25M.exe"16⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\vyoyD3NZn6Pqk13vHQw_Ts41.exe"C:\Users\Admin\Documents\vyoyD3NZn6Pqk13vHQw_Ts41.exe"16⤵
-
C:\Users\Admin\Documents\vyoyD3NZn6Pqk13vHQw_Ts41.exe"C:\Users\Admin\Documents\vyoyD3NZn6Pqk13vHQw_Ts41.exe"17⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\0DPbuhMgwwCQ3N8r_cWCgnLC.exe"C:\Users\Admin\Documents\0DPbuhMgwwCQ3N8r_cWCgnLC.exe"16⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 0DPbuhMgwwCQ3N8r_cWCgnLC.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0DPbuhMgwwCQ3N8r_cWCgnLC.exe" & del C:\ProgramData\*.dll & exit17⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 0DPbuhMgwwCQ3N8r_cWCgnLC.exe /f18⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 618⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\PB8ehFg7hsLT7fZEljw55gaz.exe"C:\Users\Admin\Documents\PB8ehFg7hsLT7fZEljw55gaz.exe"16⤵
-
C:\Users\Admin\Documents\VM5_8Vz9RniAnjqgCuzqy46q.exe"C:\Users\Admin\Documents\VM5_8Vz9RniAnjqgCuzqy46q.exe"16⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\xFg0Bc4hPArdysmZqZFiE8KC.exe"C:\Users\Admin\Documents\xFg0Bc4hPArdysmZqZFiE8KC.exe"16⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\Documents\qw0cOWRNb2CIE9dhmG8PACCY.exe"C:\Users\Admin\Documents\qw0cOWRNb2CIE9dhmG8PACCY.exe"16⤵
-
C:\Users\Admin\Documents\qw0cOWRNb2CIE9dhmG8PACCY.exe"C:\Users\Admin\Documents\qw0cOWRNb2CIE9dhmG8PACCY.exe" -a17⤵
-
C:\Users\Admin\Documents\MkIjY0hUdkbyHW7E3PYhVP38.exe"C:\Users\Admin\Documents\MkIjY0hUdkbyHW7E3PYhVP38.exe"11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\MkIjY0hUdkbyHW7E3PYhVP38.exeC:\Users\Admin\Documents\MkIjY0hUdkbyHW7E3PYhVP38.exe12⤵
-
C:\Users\Admin\Documents\HrrK2U03KQjYUU8YWNsy54pB.exe"C:\Users\Admin\Documents\HrrK2U03KQjYUU8YWNsy54pB.exe"11⤵
-
C:\Users\Admin\Documents\HrrK2U03KQjYUU8YWNsy54pB.exeC:\Users\Admin\Documents\HrrK2U03KQjYUU8YWNsy54pB.exe12⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im HrrK2U03KQjYUU8YWNsy54pB.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\HrrK2U03KQjYUU8YWNsy54pB.exe" & del C:\ProgramData\*.dll & exit13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im HrrK2U03KQjYUU8YWNsy54pB.exe /f14⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 614⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\l7uceB9wT2i0TOm6OSqk2Qly.exe"C:\Users\Admin\Documents\l7uceB9wT2i0TOm6OSqk2Qly.exe"11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\l7uceB9wT2i0TOm6OSqk2Qly.exeC:\Users\Admin\Documents\l7uceB9wT2i0TOm6OSqk2Qly.exe12⤵
-
C:\Users\Admin\Documents\RNSIGPl716nGRHRM_5ruhWJ6.exe"C:\Users\Admin\Documents\RNSIGPl716nGRHRM_5ruhWJ6.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\Documents\sVd43iem2yJnbjSynxJ6INV_.exe"C:\Users\Admin\Documents\sVd43iem2yJnbjSynxJ6INV_.exe"11⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\cBpNK0JqK1UxOztKt1gxZDs4.exe"C:\Users\Admin\Documents\cBpNK0JqK1UxOztKt1gxZDs4.exe"11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\cBpNK0JqK1UxOztKt1gxZDs4.exeC:\Users\Admin\Documents\cBpNK0JqK1UxOztKt1gxZDs4.exe12⤵
-
C:\Users\Admin\Documents\GfBxSJhYJ0nlVZaCFoT_rxos.exe"C:\Users\Admin\Documents\GfBxSJhYJ0nlVZaCFoT_rxos.exe"11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\GfBxSJhYJ0nlVZaCFoT_rxos.exeC:\Users\Admin\Documents\GfBxSJhYJ0nlVZaCFoT_rxos.exe12⤵
-
C:\Users\Admin\Documents\NfmC7Z3q_zmfTcO7EYb9mfmm.exe"C:\Users\Admin\Documents\NfmC7Z3q_zmfTcO7EYb9mfmm.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp12⤵
-
C:\Windows\SysWOW64\cmd.execmd13⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp14⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.comAcre.exe.com k14⤵
- Drops startup file
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 3014⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\Ng3fRJnm2X35mUYb2guSldMg.exe"C:\Users\Admin\Documents\Ng3fRJnm2X35mUYb2guSldMg.exe"11⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Ng3fRJnm2X35mUYb2guSldMg.exeC:\Users\Admin\Documents\Ng3fRJnm2X35mUYb2guSldMg.exe12⤵
-
C:\Users\Admin\Documents\CHmXPiT5MHZEaYEW0bU5zjOO.exe"C:\Users\Admin\Documents\CHmXPiT5MHZEaYEW0bU5zjOO.exe"11⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\Documents\EHO8lR_vjhpbFvHsoZdsIht2.exe"C:\Users\Admin\Documents\EHO8lR_vjhpbFvHsoZdsIht2.exe"11⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\Jb743l0yI2f5LBucAcIqTm0k.exe"C:\Users\Admin\Documents\Jb743l0yI2f5LBucAcIqTm0k.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\1070793794.exeC:\Users\Admin\AppData\Local\Temp\1070793794.exe12⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1070793794.exeC:\Users\Admin\AppData\Local\Temp\1070793794.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\1070793794.exeC:\Users\Admin\AppData\Local\Temp\1070793794.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\1070793794.exeC:\Users\Admin\AppData\Local\Temp\1070793794.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\451586966.exeC:\Users\Admin\AppData\Local\Temp\451586966.exe12⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\451586966.exeC:\Users\Admin\AppData\Local\Temp\451586966.exe13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\Documents\Jb743l0yI2f5LBucAcIqTm0k.exe & exit12⤵
-
C:\Windows\SysWOW64\PING.EXEping 013⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\JjZDSvbNDxAZqKXnnN92hKhL.exe"C:\Users\Admin\Documents\JjZDSvbNDxAZqKXnnN92hKhL.exe"11⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\SQBi2b1kNPdFTdviA76217BX.exe"C:\Users\Admin\Documents\SQBi2b1kNPdFTdviA76217BX.exe"11⤵
-
C:\Users\Admin\Documents\ly60ll32L_bDjXxDUQk8yzy6.exe"C:\Users\Admin\Documents\ly60ll32L_bDjXxDUQk8yzy6.exe"11⤵
-
C:\Users\Admin\Documents\ly60ll32L_bDjXxDUQk8yzy6.exe"C:\Users\Admin\Documents\ly60ll32L_bDjXxDUQk8yzy6.exe"12⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\c63kPCHYuzCG5rFLaa4eavoi.exe"C:\Users\Admin\Documents\c63kPCHYuzCG5rFLaa4eavoi.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im c63kPCHYuzCG5rFLaa4eavoi.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\c63kPCHYuzCG5rFLaa4eavoi.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im c63kPCHYuzCG5rFLaa4eavoi.exe /f13⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\3T5lJ1tSp7IAURg6WGVbyw_U.exe"C:\Users\Admin\Documents\3T5lJ1tSp7IAURg6WGVbyw_U.exe"11⤵
-
C:\Users\Admin\Documents\3T5lJ1tSp7IAURg6WGVbyw_U.exe"C:\Users\Admin\Documents\3T5lJ1tSp7IAURg6WGVbyw_U.exe" -a12⤵
-
C:\Users\Admin\Documents\gcN4vjRaRQ09r0mmKWbHNSmo.exe"C:\Users\Admin\Documents\gcN4vjRaRQ09r0mmKWbHNSmo.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 10807⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_3.exesonia_3.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3096 -s 17322⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\16EF.exeC:\Users\Admin\AppData\Local\Temp\16EF.exe1⤵
-
C:\ProgramData\5MH65BPWKD0YNUAK.exe"C:\ProgramData\5MH65BPWKD0YNUAK.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 16EF.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\16EF.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 16EF.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\4572.exeC:\Users\Admin\AppData\Local\Temp\4572.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Loads dropped DLL
- Checks processor information in registry
- NTFS ADS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Defense Evasion
Modify Registry
4Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
9c1b65c54b8f7b1946eb9ff092af386e
SHA17ec5379448398329bc60b8b9be574c9394675e25
SHA25605746198e4288bc07ca2993b45165ef66b3436f5b1f78f79ffd7da2ebbe1b039
SHA5121a55c15f8faf4ee6d474f2a6758901a67ad506d3a70264433e8731868a29ab3df225f11222e63281d420c461d4389c2b90219f5c42501c64943836d8d6f2ba1f
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_1.txtMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_2.exeMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_2.txtMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_3.exeMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_3.txtMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_4.exeMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_4.txtMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_5.exeMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_5.txtMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_6.exeMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\7zS89819B14\sonia_6.txtMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exeMD5
ba5a8020b3022821fd9510a50be8d004
SHA11700f22d6db1c3d8db9c10856dd96b3a86bac4bd
SHA2567200d50443abb0f9bd8a7ef553d1cfcfd359ae1cf999cf82f285a2720affa306
SHA512a4e70b5c8d48ca4b7d310af3ce12a3079f6ddfdd95913d6eb6e702d07ba3120d6b90c188a2fee477b0a8f1fe72cae62834ec69940b3a00eb89f90fa4c7fe7cb0
-
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exeMD5
ba5a8020b3022821fd9510a50be8d004
SHA11700f22d6db1c3d8db9c10856dd96b3a86bac4bd
SHA2567200d50443abb0f9bd8a7ef553d1cfcfd359ae1cf999cf82f285a2720affa306
SHA512a4e70b5c8d48ca4b7d310af3ce12a3079f6ddfdd95913d6eb6e702d07ba3120d6b90c188a2fee477b0a8f1fe72cae62834ec69940b3a00eb89f90fa4c7fe7cb0
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
56bd0f698f28e63479e5697dd167926e
SHA1a65ab942eb3b3ac45ecf24cf1a35d2734f14d666
SHA2566a481c56aa97b2a75a3de488ce1a9a670c62fc364a432e8e68497f55fabb439d
SHA512f8900374349e22a2eb2c4ae2598bb1ed5b0dd3ca2857e2fb10d2ed3474fea49a810eb92eb3a81e861bd47c54698fa934fe086bca7da6a1f164c34753b6d391f2
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
56bd0f698f28e63479e5697dd167926e
SHA1a65ab942eb3b3ac45ecf24cf1a35d2734f14d666
SHA2566a481c56aa97b2a75a3de488ce1a9a670c62fc364a432e8e68497f55fabb439d
SHA512f8900374349e22a2eb2c4ae2598bb1ed5b0dd3ca2857e2fb10d2ed3474fea49a810eb92eb3a81e861bd47c54698fa934fe086bca7da6a1f164c34753b6d391f2
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeMD5
8ddd5b9dbcd4e37135868db27b675c2d
SHA19122af279871de3f92ac3728e2343950f3e8b995
SHA2562f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f
SHA512e712688ffe6d30aa1b21cba4fa88a6d1c4f72ba3b7d672ee2e790a6a42bc40df02761ced6a5cebcd5bc5ac6c5a2cdad7b04f427e3f02fb225132214b3e68664f
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeMD5
8ddd5b9dbcd4e37135868db27b675c2d
SHA19122af279871de3f92ac3728e2343950f3e8b995
SHA2562f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f
SHA512e712688ffe6d30aa1b21cba4fa88a6d1c4f72ba3b7d672ee2e790a6a42bc40df02761ced6a5cebcd5bc5ac6c5a2cdad7b04f427e3f02fb225132214b3e68664f
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeMD5
8ddd5b9dbcd4e37135868db27b675c2d
SHA19122af279871de3f92ac3728e2343950f3e8b995
SHA2562f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f
SHA512e712688ffe6d30aa1b21cba4fa88a6d1c4f72ba3b7d672ee2e790a6a42bc40df02761ced6a5cebcd5bc5ac6c5a2cdad7b04f427e3f02fb225132214b3e68664f
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
99ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exeMD5
e4b4e8239211d0334ea235cf9fc8b272
SHA1dfd916e4074e177288e62c444f947d408963cf8d
SHA256d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b
SHA512ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exeMD5
e4b4e8239211d0334ea235cf9fc8b272
SHA1dfd916e4074e177288e62c444f947d408963cf8d
SHA256d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b
SHA512ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf
-
C:\Users\Admin\AppData\Local\Temp\setup 326.exeMD5
b0bbb046e84232ecd2c072418808a2d7
SHA123064a1294b01edfe8e3d77e9b553850f54b1f63
SHA2569938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d
SHA5126ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2
-
C:\Users\Admin\AppData\Local\Temp\setup 326.exeMD5
b0bbb046e84232ecd2c072418808a2d7
SHA123064a1294b01edfe8e3d77e9b553850f54b1f63
SHA2569938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d
SHA5126ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
f045d3467289a1b177b33c35c726e5ed
SHA101b96307874f1a1a277bf062e03f2a47a6c906d0
SHA256a8e6248c5472e049abd81f8678457b9f94453a67cb6edb45578ed69a0b926bce
SHA5125b76dab8503156f23506ee6e4834b46bb2611698edbc5d305eccea52d168c95eabd3343691ede96f8d0194fe69afd424795832ee03409a15f058d57cbc2d6e0d
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
f045d3467289a1b177b33c35c726e5ed
SHA101b96307874f1a1a277bf062e03f2a47a6c906d0
SHA256a8e6248c5472e049abd81f8678457b9f94453a67cb6edb45578ed69a0b926bce
SHA5125b76dab8503156f23506ee6e4834b46bb2611698edbc5d305eccea52d168c95eabd3343691ede96f8d0194fe69afd424795832ee03409a15f058d57cbc2d6e0d
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exeMD5
64976dbee1d73fb7765cbec2b3612acc
SHA188afc6354280e0925b037f56df3b90e0f05946ed
SHA256b5836dfd74e9e193cb8b3ee99d34f6b93ff5b88fecdc8f0b55928407bd0af376
SHA5123113d41ace1139cd4d6f84df42c42455b4f2d4060d394710ff783cdecb4b2db2c736a14c72900d54ab8a74a1a5bc252bd73cce00f3913e9dff111974bd4b3ced
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exeMD5
64976dbee1d73fb7765cbec2b3612acc
SHA188afc6354280e0925b037f56df3b90e0f05946ed
SHA256b5836dfd74e9e193cb8b3ee99d34f6b93ff5b88fecdc8f0b55928407bd0af376
SHA5123113d41ace1139cd4d6f84df42c42455b4f2d4060d394710ff783cdecb4b2db2c736a14c72900d54ab8a74a1a5bc252bd73cce00f3913e9dff111974bd4b3ced
-
C:\Users\Admin\Documents\Dv_HhgDriI7E8LCdR1AMfCzv.exeMD5
be9b4ab2ee879c0aa4f727e5a4e25d4a
SHA149458cca9b8b56f99360219dac774c185ed6d459
SHA2562bf7a7d3424e40cfbcb0ef3d27044872cf36310a300a076c1d172cdb0d707248
SHA5123698efd3f30fc6af1133fb5b287ab47c9a8877381454171b5c6a4293ea8e3a7bd9c8eaea117d600da56cfd9e3bda7c32b15ec8e58e14106e914cb9b7af192e0d
-
C:\Users\Admin\Documents\IsJLKYUTzY9fr08H7FNU_XXs.exeMD5
f4b5014ee478e3cbe5874505313ae8ba
SHA1c1795ce76f603013a42a35682bd6bf97067c4fe9
SHA2568e7121b812c07d5fb5dda8e5f8a8d0529d87d6f6332f0509758fc8e79c643d01
SHA5129167bbcaba7cca3e8609446f482ad26c1768e89fd986a3e24cf33f7c25c41cd503944f4866852fe5a55a6715b1d7d0e97bde43d176c000b69397e95f30bf702e
-
C:\Users\Admin\Documents\_5ESty5sWL_a7y2OwqlBufqt.exeMD5
2a7c37dcd051615f9983bcfbea17cdb1
SHA1c9b7931deaf9f5f679770d930876c17091386ee5
SHA256030390d3bc3e482fd922902841ed06580601605c9b57e61548e8d1a0a75a4f1f
SHA512d7a2f85b49d9bcb3bbb95ce8a0c40ad086c723ccb09b11c998a63eaaec2571bd93d6a7664d3113a5db343a8f00d64cd8b9602594f49ffb38e86c87d06d13f740
-
C:\Users\Admin\Documents\o1wtY_90NH4nzz8Y3jQFRETc.exeMD5
3ae546863710d2f73270d3c14e8ac602
SHA1035e3634a89cbe46b183e59eff326fbd15714006
SHA256fccfa48edcb5a60b5d5d49850d7ddb5473ea7d14a24a3f9f556d912349945436
SHA512a75fbcdb259c763f4619337823b9fe9bcdb948964e17a6f78e55f530d470ae428267c4d7058747cfbe8ff0648097c0bb3130b4850c6e1c04d1cd6c4686d4b08a
-
C:\Users\Admin\Documents\o1wtY_90NH4nzz8Y3jQFRETc.exeMD5
3ae546863710d2f73270d3c14e8ac602
SHA1035e3634a89cbe46b183e59eff326fbd15714006
SHA256fccfa48edcb5a60b5d5d49850d7ddb5473ea7d14a24a3f9f556d912349945436
SHA512a75fbcdb259c763f4619337823b9fe9bcdb948964e17a6f78e55f530d470ae428267c4d7058747cfbe8ff0648097c0bb3130b4850c6e1c04d1cd6c4686d4b08a
-
C:\Users\Admin\Documents\x2Ezdo1WDoaOcNFcxcdqmBxR.exeMD5
117f7307c398609442dd30ac091621a3
SHA10341f25b6bafd088d592d9dc03b447382edf48a2
SHA2563ae097ee6a269763737b21e1cdfb7277b049998b4396b52f752b1cc2c9cb2da2
SHA5127024843100e88a471dc787cbbaaf034a49894548b5fe613f7dafc9131a6f246cdd2c9ed95789b2fa902d6fd0abd2b8fd6590be28df347f36c69d879cb3f5c99a
-
C:\Windows\winnetdriv.exeMD5
b0bbb046e84232ecd2c072418808a2d7
SHA123064a1294b01edfe8e3d77e9b553850f54b1f63
SHA2569938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d
SHA5126ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2
-
C:\Windows\winnetdriv.exeMD5
b0bbb046e84232ecd2c072418808a2d7
SHA123064a1294b01edfe8e3d77e9b553850f54b1f63
SHA2569938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d
SHA5126ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2
-
\Users\Admin\AppData\Local\Temp\7zS89819B14\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS89819B14\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS89819B14\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS89819B14\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS89819B14\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS89819B14\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
memory/488-386-0x000001CDD16C0000-0x000001CDD1791000-memory.dmpFilesize
836KB
-
memory/488-292-0x0000000000000000-mapping.dmp
-
memory/488-380-0x000001CDCFA70000-0x000001CDCFADF000-memory.dmpFilesize
444KB
-
memory/792-425-0x0000000005380000-0x0000000005986000-memory.dmpFilesize
6.0MB
-
memory/792-389-0x0000000000417DEA-mapping.dmp
-
memory/964-206-0x0000028D5D180000-0x0000028D5D1F1000-memory.dmpFilesize
452KB
-
memory/1008-211-0x00000133CC560000-0x00000133CC5D1000-memory.dmpFilesize
452KB
-
memory/1064-219-0x0000021D7A270000-0x0000021D7A2E1000-memory.dmpFilesize
452KB
-
memory/1140-148-0x0000000000000000-mapping.dmp
-
memory/1236-236-0x00000145B3CA0000-0x00000145B3D11000-memory.dmpFilesize
452KB
-
memory/1260-237-0x00000261A8860000-0x00000261A88D1000-memory.dmpFilesize
452KB
-
memory/1368-213-0x00000235F9560000-0x00000235F95D1000-memory.dmpFilesize
452KB
-
memory/1432-376-0x0000000000417E26-mapping.dmp
-
memory/1432-420-0x0000000004D10000-0x0000000005316000-memory.dmpFilesize
6.0MB
-
memory/1608-209-0x0000025E14A40000-0x0000025E14AB1000-memory.dmpFilesize
452KB
-
memory/1608-185-0x00007FF7CC9C4060-mapping.dmp
-
memory/1676-157-0x0000000000000000-mapping.dmp
-
memory/1744-429-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/1744-350-0x0000000000000000-mapping.dmp
-
memory/1744-371-0x0000000077C00000-0x0000000077D8E000-memory.dmpFilesize
1.6MB
-
memory/1756-346-0x0000000004CE0000-0x0000000004D56000-memory.dmpFilesize
472KB
-
memory/1756-330-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/1756-299-0x0000000000000000-mapping.dmp
-
memory/1824-220-0x0000018F53040000-0x0000018F530B1000-memory.dmpFilesize
452KB
-
memory/1868-365-0x0000000000000000-mapping.dmp
-
memory/1908-169-0x0000000000000000-mapping.dmp
-
memory/2128-166-0x000000001B930000-0x000000001B932000-memory.dmpFilesize
8KB
-
memory/2128-151-0x0000000000000000-mapping.dmp
-
memory/2128-160-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/2152-155-0x0000000000000000-mapping.dmp
-
memory/2200-114-0x0000000000000000-mapping.dmp
-
memory/2272-465-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2300-472-0x000001D021270000-0x000001D0212E1000-memory.dmpFilesize
452KB
-
memory/2300-471-0x000001D020FB0000-0x000001D020FFC000-memory.dmpFilesize
304KB
-
memory/2300-203-0x000001D020F60000-0x000001D020FAC000-memory.dmpFilesize
304KB
-
memory/2300-205-0x000001D021020000-0x000001D021091000-memory.dmpFilesize
452KB
-
memory/2336-217-0x0000023ABF850000-0x0000023ABF8C1000-memory.dmpFilesize
452KB
-
memory/2344-190-0x0000000000000000-mapping.dmp
-
memory/2344-212-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/2376-215-0x000001565C440000-0x000001565C4B1000-memory.dmpFilesize
452KB
-
memory/2392-321-0x0000000000000000-mapping.dmp
-
memory/2536-207-0x0000018121CD0000-0x0000018121D41000-memory.dmpFilesize
452KB
-
memory/2596-457-0x0000000000400000-0x00000000009F0000-memory.dmpFilesize
5.9MB
-
memory/2596-323-0x0000000000000000-mapping.dmp
-
memory/2596-453-0x0000000000C50000-0x0000000000CED000-memory.dmpFilesize
628KB
-
memory/2624-238-0x0000024DE6610000-0x0000024DE6681000-memory.dmpFilesize
452KB
-
memory/2632-240-0x0000022E04A00000-0x0000022E04A71000-memory.dmpFilesize
452KB
-
memory/2764-251-0x0000000000580000-0x0000000000595000-memory.dmpFilesize
84KB
-
memory/2864-370-0x0000000000417E1E-mapping.dmp
-
memory/2864-411-0x0000000004C40000-0x0000000005246000-memory.dmpFilesize
6.0MB
-
memory/3000-353-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/3000-338-0x0000000000000000-mapping.dmp
-
memory/3000-368-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/3080-439-0x0000000005550000-0x0000000005B56000-memory.dmpFilesize
6.0MB
-
memory/3080-174-0x0000000000000000-mapping.dmp
-
memory/3080-179-0x0000000004D80000-0x0000000004DDD000-memory.dmpFilesize
372KB
-
memory/3080-412-0x0000000000417DEA-mapping.dmp
-
memory/3080-182-0x0000000004C76000-0x0000000004D77000-memory.dmpFilesize
1.0MB
-
memory/3088-303-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/3088-291-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3088-294-0x0000000000417E1A-mapping.dmp
-
memory/3088-310-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3088-343-0x00000000052E0000-0x00000000058E6000-memory.dmpFilesize
6.0MB
-
memory/3088-306-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/3096-181-0x0000000000400000-0x00000000008F2000-memory.dmpFilesize
4.9MB
-
memory/3096-180-0x0000000000B40000-0x0000000000BDD000-memory.dmpFilesize
628KB
-
memory/3096-153-0x0000000000000000-mapping.dmp
-
memory/3104-150-0x0000000000000000-mapping.dmp
-
memory/3104-177-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3104-178-0x0000000000400000-0x0000000000896000-memory.dmpFilesize
4.6MB
-
memory/3424-141-0x0000000000000000-mapping.dmp
-
memory/3456-144-0x0000000000000000-mapping.dmp
-
memory/3464-145-0x0000000000000000-mapping.dmp
-
memory/3616-154-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3616-134-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3616-133-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3616-132-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3616-131-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3616-159-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3616-162-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3616-165-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3616-117-0x0000000000000000-mapping.dmp
-
memory/3632-143-0x0000000000000000-mapping.dmp
-
memory/3744-469-0x0000000003560000-0x00000000035BD000-memory.dmpFilesize
372KB
-
memory/3744-463-0x0000000000000000-mapping.dmp
-
memory/3744-467-0x0000000004F2A000-0x000000000502B000-memory.dmpFilesize
1.0MB
-
memory/3748-147-0x0000000000000000-mapping.dmp
-
memory/3920-446-0x0000000000417DEE-mapping.dmp
-
memory/3920-461-0x00000000053F0000-0x00000000059F6000-memory.dmpFilesize
6.0MB
-
memory/3996-146-0x0000000000000000-mapping.dmp
-
memory/4020-142-0x0000000000000000-mapping.dmp
-
memory/4040-167-0x0000000000000000-mapping.dmp
-
memory/4104-407-0x0000000000000000-mapping.dmp
-
memory/4128-454-0x0000000000000000-mapping.dmp
-
memory/4136-270-0x0000000000000000-mapping.dmp
-
memory/4136-273-0x00000160C58C0000-0x00000160C58C1000-memory.dmpFilesize
4KB
-
memory/4204-456-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/4204-447-0x0000000000000000-mapping.dmp
-
memory/4224-433-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/4224-342-0x0000000000000000-mapping.dmp
-
memory/4224-375-0x0000000077C00000-0x0000000077D8E000-memory.dmpFilesize
1.6MB
-
memory/4228-339-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/4228-280-0x0000000000000000-mapping.dmp
-
memory/4228-304-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/4296-336-0x000000001B390000-0x000000001B392000-memory.dmpFilesize
8KB
-
memory/4296-349-0x0000000002760000-0x0000000002783000-memory.dmpFilesize
140KB
-
memory/4296-283-0x0000000000000000-mapping.dmp
-
memory/4296-351-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/4296-313-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/4296-298-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/4320-277-0x0000000000000000-mapping.dmp
-
memory/4428-281-0x0000000000000000-mapping.dmp
-
memory/4428-348-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/4428-312-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/4464-340-0x0000000000000000-mapping.dmp
-
memory/4480-318-0x0000000000000000-mapping.dmp
-
memory/4480-324-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/4480-332-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/4484-227-0x0000000000000000-mapping.dmp
-
memory/4492-341-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/4492-305-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/4492-282-0x0000000000000000-mapping.dmp
-
memory/4528-441-0x0000000000000000-mapping.dmp
-
memory/4552-356-0x0000000000000000-mapping.dmp
-
memory/4588-232-0x0000000000000000-mapping.dmp
-
memory/4604-267-0x0000000002650000-0x0000000002651000-memory.dmpFilesize
4KB
-
memory/4604-274-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/4604-255-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4604-247-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/4604-233-0x0000000000000000-mapping.dmp
-
memory/4628-416-0x000000000046B76D-mapping.dmp
-
memory/4628-423-0x0000000000400000-0x00000000004A1000-memory.dmpFilesize
644KB
-
memory/4748-329-0x00000000051C0000-0x00000000057C6000-memory.dmpFilesize
6.0MB
-
memory/4748-295-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/4748-327-0x0000000005310000-0x0000000005311000-memory.dmpFilesize
4KB
-
memory/4748-287-0x0000000000000000-mapping.dmp
-
memory/4800-360-0x0000000077C00000-0x0000000077D8E000-memory.dmpFilesize
1.6MB
-
memory/4800-316-0x0000000000000000-mapping.dmp
-
memory/4800-415-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/4812-243-0x0000000000B00000-0x0000000000BE4000-memory.dmpFilesize
912KB
-
memory/4812-239-0x0000000000000000-mapping.dmp
-
memory/4868-345-0x0000000000000000-mapping.dmp
-
memory/4868-354-0x0000000000400000-0x000000000064F000-memory.dmpFilesize
2.3MB
-
memory/4932-252-0x0000000000000000-mapping.dmp
-
memory/4932-404-0x0000000000A90000-0x0000000000ABE000-memory.dmpFilesize
184KB
-
memory/4932-435-0x0000000000400000-0x00000000009BE000-memory.dmpFilesize
5.7MB
-
memory/5012-256-0x0000000000000000-mapping.dmp
-
memory/5012-260-0x0000000000400000-0x00000000004E4000-memory.dmpFilesize
912KB
-
memory/5024-257-0x0000000000000000-mapping.dmp
-
memory/5028-434-0x0000000000000000-mapping.dmp
-
memory/5040-317-0x0000000000000000-mapping.dmp
-
memory/5048-466-0x00000000008B0000-0x00000000008F7000-memory.dmpFilesize
284KB
-
memory/5048-347-0x0000000000000000-mapping.dmp
-
memory/5068-334-0x0000000000000000-mapping.dmp
-
memory/5068-464-0x0000000000400000-0x00000000008AA000-memory.dmpFilesize
4.7MB
-
memory/5068-460-0x00000000001C0000-0x00000000001EF000-memory.dmpFilesize
188KB
-
memory/5116-302-0x0000000000000000-mapping.dmp