Analysis
-
max time kernel
188s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
22-02-2022 03:39
Static task
static1
Behavioral task
behavioral1
Sample
37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe
Resource
win10v2004-en-20220112
General
-
Target
37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe
-
Size
7.8MB
-
MD5
b746baab68a1fa1595ab35bc83ec43e8
-
SHA1
4aafc588fc5bd85c554f15bc086fa544bf57f833
-
SHA256
37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb
-
SHA512
efd04d81f900addeab17fcb0e9faaf1448fcfa1ddecaa21b18b7754519d2e404fee29e6fc58b4d0c0153eddcae4a8b019df6cba6fe3f46df2f303a367a13b0fe
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
Glupteba Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3956-171-0x00000000051C0000-0x0000000005AE6000-memory.dmp family_glupteba behavioral2/memory/3956-172-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba behavioral2/memory/2688-192-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba behavioral2/memory/3080-197-0x0000000005700000-0x0000000006026000-memory.dmp family_glupteba behavioral2/memory/3080-198-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2872 1752 rUNdlL32.eXe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 3572 created 3452 3572 WerFault.exe rundll32.exe PID 740 created 1396 740 WerFault.exe File.exe -
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Downloads MZ/PE file
-
Executes dropped EXE 16 IoCs
Processes:
md9_1sjm.exeSoCleanInst.exeFolder.exeInfo.exeFolder.exeUpdbdate.exeFile.exeInstall.exepub2.exeFiles.exejfiag3g_gg.exejfiag3g_gg.exeInfo.exeBd9VIXsnKbe97HUqQ2CX19AE.execsrss.exeinjector.exepid process 3300 md9_1sjm.exe 912 SoCleanInst.exe 4012 Folder.exe 3956 Info.exe 2336 Folder.exe 3560 Updbdate.exe 1396 File.exe 3596 Install.exe 3800 pub2.exe 3532 Files.exe 3256 jfiag3g_gg.exe 204 jfiag3g_gg.exe 2688 Info.exe 3244 Bd9VIXsnKbe97HUqQ2CX19AE.exe 3080 csrss.exe 1940 injector.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exeFolder.exeFile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation Folder.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation File.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3452 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Files.exeInfo.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.ex" Files.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LingeringGlitter = "\"C:\\Windows\\rss\\csrss.exe\"" Info.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md9_1sjm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md9_1sjm.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 116 ipinfo.io 66 ip-api.com 115 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Drops file in Windows directory 6 IoCs
Processes:
WerFault.exeInfo.exesvchost.exeTiWorker.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\rss Info.exe File created C:\Windows\rss\csrss.exe Info.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 62 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3216 3452 WerFault.exe rundll32.exe 1128 3452 WerFault.exe rundll32.exe 3916 3956 WerFault.exe Info.exe 204 3956 WerFault.exe Info.exe 2196 3956 WerFault.exe Info.exe 3248 3956 WerFault.exe Info.exe 4056 3956 WerFault.exe Info.exe 3744 3956 WerFault.exe Info.exe 3308 3956 WerFault.exe Info.exe 1244 3956 WerFault.exe Info.exe 2432 3956 WerFault.exe Info.exe 1488 3956 WerFault.exe Info.exe 2536 3956 WerFault.exe Info.exe 2784 3956 WerFault.exe Info.exe 1052 3956 WerFault.exe Info.exe 3228 3956 WerFault.exe Info.exe 1564 3956 WerFault.exe Info.exe 4056 3956 WerFault.exe Info.exe 752 3956 WerFault.exe Info.exe 3264 3956 WerFault.exe Info.exe 2872 2688 WerFault.exe Info.exe 2940 2688 WerFault.exe Info.exe 1264 2688 WerFault.exe Info.exe 1160 2688 WerFault.exe Info.exe 2584 2688 WerFault.exe Info.exe 3676 1396 WerFault.exe File.exe 460 2688 WerFault.exe Info.exe 788 2688 WerFault.exe Info.exe 2796 2688 WerFault.exe Info.exe 1176 2688 WerFault.exe Info.exe 1328 2688 WerFault.exe Info.exe 560 2688 WerFault.exe Info.exe 3428 2688 WerFault.exe Info.exe 1316 2688 WerFault.exe Info.exe 4080 2688 WerFault.exe Info.exe 3512 2688 WerFault.exe Info.exe 2584 2688 WerFault.exe Info.exe 1896 3080 WerFault.exe csrss.exe 3820 3080 WerFault.exe csrss.exe 928 3080 WerFault.exe csrss.exe 3832 3080 WerFault.exe csrss.exe 3716 3080 WerFault.exe csrss.exe 2548 3080 WerFault.exe csrss.exe 3888 3080 WerFault.exe csrss.exe 3312 3080 WerFault.exe csrss.exe 3884 3080 WerFault.exe csrss.exe 560 3080 WerFault.exe csrss.exe 3232 3080 WerFault.exe csrss.exe 1492 3080 WerFault.exe csrss.exe 4028 3080 WerFault.exe csrss.exe 3208 3080 WerFault.exe csrss.exe 3396 3080 WerFault.exe csrss.exe 3228 3080 WerFault.exe csrss.exe 1560 3080 WerFault.exe csrss.exe 828 3080 WerFault.exe csrss.exe 3800 3080 WerFault.exe csrss.exe 1516 3080 WerFault.exe csrss.exe 1760 3080 WerFault.exe csrss.exe 1896 3080 WerFault.exe csrss.exe 228 3080 WerFault.exe csrss.exe 3840 3080 WerFault.exe csrss.exe 2188 3080 WerFault.exe csrss.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
pub2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
WerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1120 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
Info.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" Info.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" Info.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.169027" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" Info.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" Info.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" Info.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" Info.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" Info.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" Info.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pub2.exepid process 3800 pub2.exe 3800 pub2.exe 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 2416 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
pub2.exepid process 3800 pub2.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exeSoCleanInst.exeInstall.exedescription pid process Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeBackupPrivilege 4088 TiWorker.exe Token: SeRestorePrivilege 4088 TiWorker.exe Token: SeSecurityPrivilege 4088 TiWorker.exe Token: SeDebugPrivilege 912 SoCleanInst.exe Token: SeCreateTokenPrivilege 3596 Install.exe Token: SeAssignPrimaryTokenPrivilege 3596 Install.exe Token: SeLockMemoryPrivilege 3596 Install.exe Token: SeIncreaseQuotaPrivilege 3596 Install.exe Token: SeMachineAccountPrivilege 3596 Install.exe Token: SeTcbPrivilege 3596 Install.exe Token: SeSecurityPrivilege 3596 Install.exe Token: SeTakeOwnershipPrivilege 3596 Install.exe Token: SeLoadDriverPrivilege 3596 Install.exe Token: SeSystemProfilePrivilege 3596 Install.exe Token: SeSystemtimePrivilege 3596 Install.exe Token: SeProfSingleProcessPrivilege 3596 Install.exe Token: SeIncBasePriorityPrivilege 3596 Install.exe Token: SeCreatePagefilePrivilege 3596 Install.exe Token: SeCreatePermanentPrivilege 3596 Install.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
File.exepid process 1396 File.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exeFolder.exerUNdlL32.eXeFiles.exerundll32.exeInstall.exeWerFault.execmd.exeFile.exeWerFault.exeInfo.execmd.execsrss.exedescription pid process target process PID 4020 wrote to memory of 3300 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe md9_1sjm.exe PID 4020 wrote to memory of 3300 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe md9_1sjm.exe PID 4020 wrote to memory of 3300 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe md9_1sjm.exe PID 4020 wrote to memory of 912 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe SoCleanInst.exe PID 4020 wrote to memory of 912 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe SoCleanInst.exe PID 4020 wrote to memory of 4012 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Folder.exe PID 4020 wrote to memory of 4012 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Folder.exe PID 4020 wrote to memory of 4012 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Folder.exe PID 4020 wrote to memory of 3956 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Info.exe PID 4020 wrote to memory of 3956 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Info.exe PID 4020 wrote to memory of 3956 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Info.exe PID 4012 wrote to memory of 2336 4012 Folder.exe Folder.exe PID 4012 wrote to memory of 2336 4012 Folder.exe Folder.exe PID 4012 wrote to memory of 2336 4012 Folder.exe Folder.exe PID 4020 wrote to memory of 3560 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Updbdate.exe PID 4020 wrote to memory of 3560 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Updbdate.exe PID 4020 wrote to memory of 3560 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Updbdate.exe PID 4020 wrote to memory of 1396 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe File.exe PID 4020 wrote to memory of 1396 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe File.exe PID 4020 wrote to memory of 1396 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe File.exe PID 4020 wrote to memory of 3596 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Install.exe PID 4020 wrote to memory of 3596 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Install.exe PID 4020 wrote to memory of 3596 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Install.exe PID 4020 wrote to memory of 3800 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe pub2.exe PID 4020 wrote to memory of 3800 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe pub2.exe PID 4020 wrote to memory of 3800 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe pub2.exe PID 4020 wrote to memory of 3532 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Files.exe PID 4020 wrote to memory of 3532 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Files.exe PID 4020 wrote to memory of 3532 4020 37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe Files.exe PID 2872 wrote to memory of 3452 2872 rUNdlL32.eXe rundll32.exe PID 2872 wrote to memory of 3452 2872 rUNdlL32.eXe rundll32.exe PID 2872 wrote to memory of 3452 2872 rUNdlL32.eXe rundll32.exe PID 3532 wrote to memory of 3256 3532 Files.exe jfiag3g_gg.exe PID 3532 wrote to memory of 3256 3532 Files.exe jfiag3g_gg.exe PID 3532 wrote to memory of 3256 3532 Files.exe jfiag3g_gg.exe PID 3452 wrote to memory of 3216 3452 rundll32.exe WerFault.exe PID 3452 wrote to memory of 3216 3452 rundll32.exe WerFault.exe PID 3452 wrote to memory of 3216 3452 rundll32.exe WerFault.exe PID 3532 wrote to memory of 204 3532 Files.exe jfiag3g_gg.exe PID 3532 wrote to memory of 204 3532 Files.exe jfiag3g_gg.exe PID 3532 wrote to memory of 204 3532 Files.exe jfiag3g_gg.exe PID 3596 wrote to memory of 3016 3596 Install.exe cmd.exe PID 3596 wrote to memory of 3016 3596 Install.exe cmd.exe PID 3596 wrote to memory of 3016 3596 Install.exe cmd.exe PID 3572 wrote to memory of 3452 3572 WerFault.exe rundll32.exe PID 3572 wrote to memory of 3452 3572 WerFault.exe rundll32.exe PID 3016 wrote to memory of 1120 3016 cmd.exe taskkill.exe PID 3016 wrote to memory of 1120 3016 cmd.exe taskkill.exe PID 3016 wrote to memory of 1120 3016 cmd.exe taskkill.exe PID 1396 wrote to memory of 3244 1396 File.exe Bd9VIXsnKbe97HUqQ2CX19AE.exe PID 1396 wrote to memory of 3244 1396 File.exe Bd9VIXsnKbe97HUqQ2CX19AE.exe PID 740 wrote to memory of 1396 740 WerFault.exe File.exe PID 740 wrote to memory of 1396 740 WerFault.exe File.exe PID 2688 wrote to memory of 2440 2688 Info.exe cmd.exe PID 2688 wrote to memory of 2440 2688 Info.exe cmd.exe PID 2440 wrote to memory of 1612 2440 cmd.exe netsh.exe PID 2440 wrote to memory of 1612 2440 cmd.exe netsh.exe PID 2688 wrote to memory of 3080 2688 Info.exe csrss.exe PID 2688 wrote to memory of 3080 2688 Info.exe csrss.exe PID 2688 wrote to memory of 3080 2688 Info.exe csrss.exe PID 3080 wrote to memory of 1940 3080 csrss.exe injector.exe PID 3080 wrote to memory of 1940 3080 csrss.exe injector.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe"C:\Users\Admin\AppData\Local\Temp\37e1542d68d7ef073252341ec2835f291700a02ce1b1f7c91bbfc89358e598cb.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exe"C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Info.exe"C:\Users\Admin\AppData\Local\Temp\Info.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 6243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 7123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 7123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 7243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 7483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 7283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 8843⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 8763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 6963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 7803⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 8403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 9083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 9203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 8443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 8403⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Info.exe"C:\Users\Admin\AppData\Local\Temp\Info.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 3364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 3404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 3604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 6364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 6364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 6364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 6364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 7084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 7284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 8204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 7044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 8404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 7204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 8404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 8844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 8164⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /94-944⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 3685⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 3725⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 3725⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 6245⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 7005⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 7005⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 7005⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 7365⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 7605⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 6205⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 7125⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 6045⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 6125⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 6125⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 6125⤵
- Program crash
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 9805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 9925⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 8125⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 9645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10925⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10325⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10125⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10885⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\Bd9VIXsnKbe97HUqQ2CX19AE.exe"C:\Users\Admin\Pictures\Adobe Films\Bd9VIXsnKbe97HUqQ2CX19AE.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 21763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 01⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 6043⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 6043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3452 -ip 34521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3956 -ip 39561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1396 -ip 13961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2688 -ip 26881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3080 -ip 30801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3080 -ip 30801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\File.exeMD5
cbafd60beffb18c666ff85f1517a76f9
SHA19e015cba7168b610969bfc299a4ffe4763f4fd5f
SHA256d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d
SHA512ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce
-
C:\Users\Admin\AppData\Local\Temp\File.exeMD5
cbafd60beffb18c666ff85f1517a76f9
SHA19e015cba7168b610969bfc299a4ffe4763f4fd5f
SHA256d31f2d2d991acee74d9be732c8180f37cea12aceaba324804fbcf2d0d2891a3d
SHA512ba61ac5f49827b0fba2c72f4b19540b91f8bceb8b441a713b7de00317059955ad592c88af8f9c94093077503ab3b4c4c522b0e577599ca5020ad1b0f254066ce
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
2d0217e0c70440d8c82883eadea517b9
SHA1f3b7dd6dbb43b895ba26f67370af99952b7d83cb
SHA256d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01
SHA5126d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
2d0217e0c70440d8c82883eadea517b9
SHA1f3b7dd6dbb43b895ba26f67370af99952b7d83cb
SHA256d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01
SHA5126d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
165c8d385e0af406deb1089b621c28db
SHA13d7b93f834a08a9bc790290a20aaf835aaaf9c5c
SHA2567dc6c82e185577088f88e349a6d315138cdbed3956cbb6be5af1f9c098642a33
SHA5120bbc83a67cfb0ca2f4976b04e84ba60d708ffb7f66050da73cd0a0f28cde09dfde9b762ff5ceca35c22f5461576c47e190342470c470c6360bfb4edad8e34e14
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
165c8d385e0af406deb1089b621c28db
SHA13d7b93f834a08a9bc790290a20aaf835aaaf9c5c
SHA2567dc6c82e185577088f88e349a6d315138cdbed3956cbb6be5af1f9c098642a33
SHA5120bbc83a67cfb0ca2f4976b04e84ba60d708ffb7f66050da73cd0a0f28cde09dfde9b762ff5ceca35c22f5461576c47e190342470c470c6360bfb4edad8e34e14
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
165c8d385e0af406deb1089b621c28db
SHA13d7b93f834a08a9bc790290a20aaf835aaaf9c5c
SHA2567dc6c82e185577088f88e349a6d315138cdbed3956cbb6be5af1f9c098642a33
SHA5120bbc83a67cfb0ca2f4976b04e84ba60d708ffb7f66050da73cd0a0f28cde09dfde9b762ff5ceca35c22f5461576c47e190342470c470c6360bfb4edad8e34e14
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
2d8ae85a8155eb6e73a00b731bf54927
SHA131321387579b747a8524aee33f3ed666a11c59b8
SHA256b09541e6950cabd94ea006c019fbd732529bcad74e90c8e2c033dc5856eb93a0
SHA51229cc708326e636800d82d7239ac627b85b8dbcde3be3265a664d1be4798268b7ff170b26c31c3232229e44e9a08db56bd90e24f1910c419587230bd4e8b4ce3b
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
2d8ae85a8155eb6e73a00b731bf54927
SHA131321387579b747a8524aee33f3ed666a11c59b8
SHA256b09541e6950cabd94ea006c019fbd732529bcad74e90c8e2c033dc5856eb93a0
SHA51229cc708326e636800d82d7239ac627b85b8dbcde3be3265a664d1be4798268b7ff170b26c31c3232229e44e9a08db56bd90e24f1910c419587230bd4e8b4ce3b
-
C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exeMD5
75eddcf2bf1241779c0ae1b7aa3871de
SHA113b2a9a2267416f942247b8134837bb1dcfcfaeb
SHA256c2f7cabf9ba5869f418c6e0a2c8baae5e452b4f01fa1b0e393332f01bd53db06
SHA5124f167d343dc3b0614c6d49e066f46b95544d5d8762cce3740253dccb47a672aaf13979764132f5af0e868cada6cab774dc22af5dbf46409fcaab61a5e66de65f
-
C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exeMD5
75eddcf2bf1241779c0ae1b7aa3871de
SHA113b2a9a2267416f942247b8134837bb1dcfcfaeb
SHA256c2f7cabf9ba5869f418c6e0a2c8baae5e452b4f01fa1b0e393332f01bd53db06
SHA5124f167d343dc3b0614c6d49e066f46b95544d5d8762cce3740253dccb47a672aaf13979764132f5af0e868cada6cab774dc22af5dbf46409fcaab61a5e66de65f
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exeMD5
f5834c7cad154e61edcb429e58314f7c
SHA1334ab6ad1f75b9d65e073b1aa1453ca03d43aa1e
SHA256b5e47c38be8a3e43ca9d533916c735a9165490fac846fd10fc3e27c54a4091ee
SHA512de8a9fb8b6458ac0fbe97d70b5164230d950c61ab4d6a2569810c2bd383c2e7eb0c88fb1a9c2137369401b0cd7d3a6766562865233ce92fdf58d29b8cd55bd9f
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exeMD5
f5834c7cad154e61edcb429e58314f7c
SHA1334ab6ad1f75b9d65e073b1aa1453ca03d43aa1e
SHA256b5e47c38be8a3e43ca9d533916c735a9165490fac846fd10fc3e27c54a4091ee
SHA512de8a9fb8b6458ac0fbe97d70b5164230d950c61ab4d6a2569810c2bd383c2e7eb0c88fb1a9c2137369401b0cd7d3a6766562865233ce92fdf58d29b8cd55bd9f
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
5fd2eba6df44d23c9e662763009d7f84
SHA143530574f8ac455ae263c70cc99550bc60bfa4f1
SHA2562991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f
SHA512321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeMD5
d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeMD5
d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
9178e18ea08b783eb2b750c98c3b5a60
SHA1110057c868ad2ea447322271a5f25967b8b86849
SHA256460cf0c410480cdc387879b8ee39f59c7f32f9ca791e47797d229410bbe06592
SHA5125cb50505ea9b3a7a90b1ab7eb34a1fa001de9414a2787af72aa5dc9f498ca1fad1b5d3f186b92940b378fda67aaabacaf01ac31317db63a58599e6d195ea96d6
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeMD5
a3ec5ee946f7b93287ba9cf7facc6647
SHA13595b700f8e41d45d8a8d15b42cd00cc19922647
SHA2565816801baeff9b520d4dfd930ccf147ae31a1742ff0c111c6becc87d402434f0
SHA51263efc7b19cd3301bdb4902d8ea59cae4e6c96475f6ea8215f9656a503ad763af0453e255a05dedce6dd1f6d17db964e9da1a243824676cf9611dc22974d687a6
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeMD5
a3ec5ee946f7b93287ba9cf7facc6647
SHA13595b700f8e41d45d8a8d15b42cd00cc19922647
SHA2565816801baeff9b520d4dfd930ccf147ae31a1742ff0c111c6becc87d402434f0
SHA51263efc7b19cd3301bdb4902d8ea59cae4e6c96475f6ea8215f9656a503ad763af0453e255a05dedce6dd1f6d17db964e9da1a243824676cf9611dc22974d687a6
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
7ebcb002fa575c098d582ca98e75f5dd
SHA189ac82d4789595011bda848970b1cb8530fbf4b8
SHA256bd6816bfa4e513eaeb17ae9303b6bdde1cc4d5eddcb24d4a15a1c89c8f5f7947
SHA5128d0958a2de4b8a44bb7cb3cc9e3daa3a3785258422de957c5d67ec44c1896f08cc7f10ecdec189916440e0e97efd720b47de8b3a962bbcca3990547293dd521f
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
7ebcb002fa575c098d582ca98e75f5dd
SHA189ac82d4789595011bda848970b1cb8530fbf4b8
SHA256bd6816bfa4e513eaeb17ae9303b6bdde1cc4d5eddcb24d4a15a1c89c8f5f7947
SHA5128d0958a2de4b8a44bb7cb3cc9e3daa3a3785258422de957c5d67ec44c1896f08cc7f10ecdec189916440e0e97efd720b47de8b3a962bbcca3990547293dd521f
-
C:\Users\Admin\Pictures\Adobe Films\Bd9VIXsnKbe97HUqQ2CX19AE.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\Bd9VIXsnKbe97HUqQ2CX19AE.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Windows\rss\csrss.exeMD5
165c8d385e0af406deb1089b621c28db
SHA13d7b93f834a08a9bc790290a20aaf835aaaf9c5c
SHA2567dc6c82e185577088f88e349a6d315138cdbed3956cbb6be5af1f9c098642a33
SHA5120bbc83a67cfb0ca2f4976b04e84ba60d708ffb7f66050da73cd0a0f28cde09dfde9b762ff5ceca35c22f5461576c47e190342470c470c6360bfb4edad8e34e14
-
C:\Windows\rss\csrss.exeMD5
165c8d385e0af406deb1089b621c28db
SHA13d7b93f834a08a9bc790290a20aaf835aaaf9c5c
SHA2567dc6c82e185577088f88e349a6d315138cdbed3956cbb6be5af1f9c098642a33
SHA5120bbc83a67cfb0ca2f4976b04e84ba60d708ffb7f66050da73cd0a0f28cde09dfde9b762ff5ceca35c22f5461576c47e190342470c470c6360bfb4edad8e34e14
-
memory/912-140-0x0000000000570000-0x00000000005A4000-memory.dmpFilesize
208KB
-
memory/1396-184-0x0000000003B90000-0x0000000003D4D000-memory.dmpFilesize
1.7MB
-
memory/2416-182-0x0000000001140000-0x0000000001156000-memory.dmpFilesize
88KB
-
memory/2688-192-0x0000000000400000-0x0000000000D41000-memory.dmpFilesize
9.3MB
-
memory/2688-191-0x0000000004C11000-0x000000000504D000-memory.dmpFilesize
4.2MB
-
memory/3080-198-0x0000000000400000-0x0000000000D41000-memory.dmpFilesize
9.3MB
-
memory/3080-197-0x0000000005700000-0x0000000006026000-memory.dmpFilesize
9.1MB
-
memory/3080-196-0x0000000005200000-0x000000000563C000-memory.dmpFilesize
4.2MB
-
memory/3300-167-0x0000000004510000-0x0000000004518000-memory.dmpFilesize
32KB
-
memory/3300-166-0x00000000030E0000-0x00000000030F0000-memory.dmpFilesize
64KB
-
memory/3300-174-0x0000000000400000-0x000000000062B000-memory.dmpFilesize
2.2MB
-
memory/3300-175-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/3300-187-0x0000000004C30000-0x0000000004C38000-memory.dmpFilesize
32KB
-
memory/3560-189-0x0000000004600000-0x0000000004612000-memory.dmpFilesize
72KB
-
memory/3560-195-0x00000000026C4000-0x00000000026C6000-memory.dmpFilesize
8KB
-
memory/3560-183-0x000000007164E000-0x000000007164F000-memory.dmpFilesize
4KB
-
memory/3560-144-0x00000000023E9000-0x000000000240B000-memory.dmpFilesize
136KB
-
memory/3560-181-0x00000000026C3000-0x00000000026C4000-memory.dmpFilesize
4KB
-
memory/3560-177-0x00000000023E9000-0x000000000240B000-memory.dmpFilesize
136KB
-
memory/3560-180-0x00000000026C2000-0x00000000026C3000-memory.dmpFilesize
4KB
-
memory/3560-188-0x0000000007900000-0x0000000007F18000-memory.dmpFilesize
6.1MB
-
memory/3560-178-0x0000000002710000-0x000000000273F000-memory.dmpFilesize
188KB
-
memory/3560-190-0x0000000004620000-0x000000000465C000-memory.dmpFilesize
240KB
-
memory/3560-179-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/3560-176-0x00000000026C0000-0x00000000026C1000-memory.dmpFilesize
4KB
-
memory/3560-173-0x0000000006D30000-0x00000000072D4000-memory.dmpFilesize
5.6MB
-
memory/3800-155-0x0000000002500000-0x0000000002509000-memory.dmpFilesize
36KB
-
memory/3800-154-0x00000000025AE000-0x00000000025BE000-memory.dmpFilesize
64KB
-
memory/3800-156-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3800-151-0x00000000025AE000-0x00000000025BE000-memory.dmpFilesize
64KB
-
memory/3956-172-0x0000000000400000-0x0000000000D41000-memory.dmpFilesize
9.3MB
-
memory/3956-171-0x00000000051C0000-0x0000000005AE6000-memory.dmpFilesize
9.1MB
-
memory/3956-170-0x0000000004C7B000-0x00000000050B7000-memory.dmpFilesize
4.2MB