Analysis
-
max time kernel
113s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
22-02-2022 16:31
Static task
static1
Behavioral task
behavioral1
Sample
15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe
Resource
win10v2004-en-20220113
General
-
Target
15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe
-
Size
8.2MB
-
MD5
2c0b55f9caebeb5a4c1b11e9ff8a7362
-
SHA1
e039ba7000da23e612a6f17e7eafee0c7ab85a93
-
SHA256
15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf
-
SHA512
2eaf38bbc006435e28c1920ae8a65d1b4562ef26eb07e940085c18f87e2a12bed158df6a3bb1022698b1a867f5965e60411b053973fceb40b79d145b4ae6f404
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
raccoon
1c0fad6805a0f65d7b597130eb9f089ffbe9857d
-
url4cnc
http://194.180.191.241/capibar
http://103.155.93.35/capibar
https://t.me/capibar
Signatures
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4332-172-0x0000000002CF0000-0x0000000003617000-memory.dmp family_glupteba behavioral2/memory/4332-173-0x0000000000400000-0x0000000000D42000-memory.dmp family_glupteba behavioral2/memory/2536-177-0x0000000000400000-0x0000000000D42000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4844 3936 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/2212-209-0x0000000000C50000-0x0000000000E81000-memory.dmp family_redline behavioral2/memory/3180-214-0x00000000008E0000-0x00000000009D4000-memory.dmp family_redline behavioral2/memory/3180-217-0x00000000008E0000-0x00000000009D4000-memory.dmp family_redline behavioral2/memory/2212-219-0x0000000000C50000-0x0000000000E81000-memory.dmp family_redline behavioral2/memory/760-221-0x0000000000980000-0x0000000000B37000-memory.dmp family_redline behavioral2/memory/760-220-0x0000000000980000-0x0000000000B37000-memory.dmp family_redline behavioral2/memory/3180-226-0x00000000008E0000-0x00000000009D4000-memory.dmp family_redline behavioral2/memory/760-230-0x0000000000980000-0x0000000000B37000-memory.dmp family_redline behavioral2/memory/760-228-0x0000000000980000-0x0000000000B37000-memory.dmp family_redline behavioral2/memory/3180-227-0x00000000008E0000-0x00000000009D4000-memory.dmp family_redline behavioral2/memory/4540-247-0x0000000000BD0000-0x0000000000D63000-memory.dmp family_redline behavioral2/memory/4540-248-0x0000000000BD2000-0x0000000000C07000-memory.dmp family_redline behavioral2/memory/4540-258-0x0000000000BD2000-0x0000000000C07000-memory.dmp family_redline behavioral2/memory/2212-267-0x0000000000C52000-0x0000000000C88000-memory.dmp family_redline behavioral2/memory/760-275-0x0000000000982000-0x00000000009B7000-memory.dmp family_redline behavioral2/memory/3180-272-0x00000000008E2000-0x0000000000915000-memory.dmp family_redline behavioral2/memory/1936-280-0x00000000001D0000-0x0000000000392000-memory.dmp family_redline behavioral2/memory/1936-281-0x00000000001D2000-0x0000000000207000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 2264 created 1540 2264 WerFault.exe rundll32.exe PID 2008 created 2400 2008 WerFault.exe lkfnWLCqL4ZUGsjdaeF4rorE.exe PID 4832 created 1244 4832 WerFault.exe aJdKnzScVDAxGyjD3LZQHLcJ.exe PID 5048 created 3324 5048 WerFault.exe GUmg4Qa4m1mIsXVgQHVxEcuJ.exe PID 1816 created 4852 1816 WerFault.exe 7_SDYekGsHoS8d1c7vPR5Bmm.exe PID 2816 created 2152 2816 WerFault.exe npdc5s5oPJorTBfKBBCgMyzp.exe PID 1624 created 4852 1624 WerFault.exe 7_SDYekGsHoS8d1c7vPR5Bmm.exe PID 4508 created 4852 4508 WerFault.exe 7_SDYekGsHoS8d1c7vPR5Bmm.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 4712 created 4332 4712 svchost.exe Graphics.exe PID 4712 created 3032 4712 svchost.exe csrss.exe -
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 40 IoCs
Processes:
SoCleanInst.exemd9_1sjm.exeFolder.exeGraphics.exeUpdbdate.exeInstall.exeFiles.exeFolder.exepub2.exeFile.exejfiag3g_gg.exejfiag3g_gg.exeGraphics.execsrss.exeKRJJGGZUDBIGnUiuMhFVCYhb.exeinjector.exe7_SDYekGsHoS8d1c7vPR5Bmm.exelkfnWLCqL4ZUGsjdaeF4rorE.exeC7UZW7dKXM1y8UR34SCgRcqo.exeNUwzeMQMokiSYVn30rwebVX9.exeVH59X1iYz5T2RQBDDWqoBZq8.exeDcygT3Ys1XLInSQIvTG_Ey6r.exesW6yBfbMVK33sD3kzI4xIvrl.exePt5JF01qRQN1iLv88FJVnzdK.exe03FkcmZZIUb_ezYCj2Qnl5il.exee00iiKWflGUeFoFf7rp6cV2_.exepRmH8et_SYzCYFyFeXuTEzdT.exegp2fgAa9GZbkz7UEyQVAFgwQ.exe_w2mF1YHUi2pPiO04GKPZfQp.exeaJdKnzScVDAxGyjD3LZQHLcJ.exenbmdzEHGf_l1ZAQ4nMMmglHF.exe1z6_khELf8T9X1MoDokR7uNw.exeGUmg4Qa4m1mIsXVgQHVxEcuJ.exemRv2cz2G0lSBxFNl9cubTIYk.exeNSE9Ld6kxxyuP8DqLvBpj6PI.exenpdc5s5oPJorTBfKBBCgMyzp.exepRmH8et_SYzCYFyFeXuTEzdT.exetGSr8Ot94Hwai4UWR8xhAPJ2.exeoG1dHne1fWPF3Po8OykVbTuX.exenbmdzEHGf_l1ZAQ4nMMmglHF.exepid process 1288 SoCleanInst.exe 2656 md9_1sjm.exe 1500 Folder.exe 4332 Graphics.exe 360 Updbdate.exe 3012 Install.exe 3436 Files.exe 4784 Folder.exe 2424 pub2.exe 424 File.exe 4088 jfiag3g_gg.exe 4328 jfiag3g_gg.exe 2536 Graphics.exe 3032 csrss.exe 4292 KRJJGGZUDBIGnUiuMhFVCYhb.exe 1960 injector.exe 4852 7_SDYekGsHoS8d1c7vPR5Bmm.exe 2400 lkfnWLCqL4ZUGsjdaeF4rorE.exe 1316 C7UZW7dKXM1y8UR34SCgRcqo.exe 428 NUwzeMQMokiSYVn30rwebVX9.exe 4912 VH59X1iYz5T2RQBDDWqoBZq8.exe 4080 DcygT3Ys1XLInSQIvTG_Ey6r.exe 4028 sW6yBfbMVK33sD3kzI4xIvrl.exe 3460 Pt5JF01qRQN1iLv88FJVnzdK.exe 2212 03FkcmZZIUb_ezYCj2Qnl5il.exe 4324 e00iiKWflGUeFoFf7rp6cV2_.exe 3568 pRmH8et_SYzCYFyFeXuTEzdT.exe 3980 gp2fgAa9GZbkz7UEyQVAFgwQ.exe 1588 _w2mF1YHUi2pPiO04GKPZfQp.exe 1244 aJdKnzScVDAxGyjD3LZQHLcJ.exe 2264 nbmdzEHGf_l1ZAQ4nMMmglHF.exe 3180 1z6_khELf8T9X1MoDokR7uNw.exe 3324 GUmg4Qa4m1mIsXVgQHVxEcuJ.exe 3564 mRv2cz2G0lSBxFNl9cubTIYk.exe 760 NSE9Ld6kxxyuP8DqLvBpj6PI.exe 2152 npdc5s5oPJorTBfKBBCgMyzp.exe 3008 pRmH8et_SYzCYFyFeXuTEzdT.exe 204 tGSr8Ot94Hwai4UWR8xhAPJ2.exe 2564 oG1dHne1fWPF3Po8OykVbTuX.exe 4484 nbmdzEHGf_l1ZAQ4nMMmglHF.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\Pictures\Adobe Films\gp2fgAa9GZbkz7UEyQVAFgwQ.exe upx C:\Users\Admin\Pictures\Adobe Films\gp2fgAa9GZbkz7UEyQVAFgwQ.exe upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
oG1dHne1fWPF3Po8OykVbTuX.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oG1dHne1fWPF3Po8OykVbTuX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oG1dHne1fWPF3Po8OykVbTuX.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exeFolder.exeFile.exeC7UZW7dKXM1y8UR34SCgRcqo.exemRv2cz2G0lSBxFNl9cubTIYk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Folder.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation File.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C7UZW7dKXM1y8UR34SCgRcqo.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation mRv2cz2G0lSBxFNl9cubTIYk.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exePt5JF01qRQN1iLv88FJVnzdK.exepid process 1540 rundll32.exe 3460 Pt5JF01qRQN1iLv88FJVnzdK.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/2564-237-0x00000000004F0000-0x00000000008B3000-memory.dmp themida behavioral2/memory/2564-239-0x00000000004F0000-0x00000000008B3000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Files.exeGraphics.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.ex" Files.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DarkFeather = "\"C:\\Windows\\rss\\csrss.exe\"" Graphics.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md9_1sjm.exeoG1dHne1fWPF3Po8OykVbTuX.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md9_1sjm.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oG1dHne1fWPF3Po8OykVbTuX.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 26 ip-api.com 118 ipinfo.io 119 ipinfo.io 239 ipinfo.io 241 ipinfo.io 263 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
03FkcmZZIUb_ezYCj2Qnl5il.exe1z6_khELf8T9X1MoDokR7uNw.exeNSE9Ld6kxxyuP8DqLvBpj6PI.exeoG1dHne1fWPF3Po8OykVbTuX.exepid process 2212 03FkcmZZIUb_ezYCj2Qnl5il.exe 3180 1z6_khELf8T9X1MoDokR7uNw.exe 760 NSE9Ld6kxxyuP8DqLvBpj6PI.exe 2564 oG1dHne1fWPF3Po8OykVbTuX.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
pRmH8et_SYzCYFyFeXuTEzdT.exenbmdzEHGf_l1ZAQ4nMMmglHF.exedescription pid process target process PID 3568 set thread context of 3008 3568 pRmH8et_SYzCYFyFeXuTEzdT.exe pRmH8et_SYzCYFyFeXuTEzdT.exe PID 2264 set thread context of 4484 2264 nbmdzEHGf_l1ZAQ4nMMmglHF.exe nbmdzEHGf_l1ZAQ4nMMmglHF.exe -
Drops file in Program Files directory 2 IoCs
Processes:
C7UZW7dKXM1y8UR34SCgRcqo.exedescription ioc process File created C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe C7UZW7dKXM1y8UR34SCgRcqo.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe C7UZW7dKXM1y8UR34SCgRcqo.exe -
Drops file in Windows directory 3 IoCs
Processes:
WerFault.exeGraphics.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\rss Graphics.exe File created C:\Windows\rss\csrss.exe Graphics.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3916 4332 WerFault.exe Graphics.exe 1604 4332 WerFault.exe Graphics.exe 4424 1540 WerFault.exe rundll32.exe 1884 4332 WerFault.exe Graphics.exe 1532 4332 WerFault.exe Graphics.exe 4260 4332 WerFault.exe Graphics.exe 2052 4332 WerFault.exe Graphics.exe 1528 4332 WerFault.exe Graphics.exe 752 4332 WerFault.exe Graphics.exe 2312 4332 WerFault.exe Graphics.exe 2008 4332 WerFault.exe Graphics.exe 3324 4332 WerFault.exe Graphics.exe 1084 4332 WerFault.exe Graphics.exe 2216 4332 WerFault.exe Graphics.exe 2160 4332 WerFault.exe Graphics.exe 4440 4332 WerFault.exe Graphics.exe 3200 4332 WerFault.exe Graphics.exe 3712 4332 WerFault.exe Graphics.exe 1736 4332 WerFault.exe Graphics.exe 1204 4332 WerFault.exe Graphics.exe 2004 4332 WerFault.exe Graphics.exe 2232 4332 WerFault.exe Graphics.exe 1488 2536 WerFault.exe Graphics.exe 1608 2536 WerFault.exe Graphics.exe 4784 2536 WerFault.exe Graphics.exe 4852 2536 WerFault.exe Graphics.exe 4372 2536 WerFault.exe Graphics.exe 2788 2536 WerFault.exe Graphics.exe 2908 2536 WerFault.exe Graphics.exe 2784 2536 WerFault.exe Graphics.exe 3596 2536 WerFault.exe Graphics.exe 768 2536 WerFault.exe Graphics.exe 1584 2536 WerFault.exe Graphics.exe 1484 2536 WerFault.exe Graphics.exe 2384 2536 WerFault.exe Graphics.exe 556 2536 WerFault.exe Graphics.exe 4792 2536 WerFault.exe Graphics.exe 5080 2536 WerFault.exe Graphics.exe 3704 3032 WerFault.exe csrss.exe 1320 3032 WerFault.exe csrss.exe 3388 3032 WerFault.exe csrss.exe 4604 3032 WerFault.exe csrss.exe 1284 3032 WerFault.exe csrss.exe 3020 3032 WerFault.exe csrss.exe 2008 3032 WerFault.exe csrss.exe 4612 3032 WerFault.exe csrss.exe 2988 3032 WerFault.exe csrss.exe 2384 3032 WerFault.exe csrss.exe 1372 3032 WerFault.exe csrss.exe 3180 3032 WerFault.exe csrss.exe 3808 3032 WerFault.exe csrss.exe 492 3032 WerFault.exe csrss.exe 2876 3032 WerFault.exe csrss.exe 4008 3032 WerFault.exe csrss.exe 4396 3032 WerFault.exe csrss.exe 3684 3032 WerFault.exe csrss.exe 4984 3032 WerFault.exe csrss.exe 4104 3032 WerFault.exe csrss.exe 4820 3032 WerFault.exe csrss.exe 1252 3032 WerFault.exe csrss.exe 480 3032 WerFault.exe csrss.exe 4600 3032 WerFault.exe csrss.exe 4076 3032 WerFault.exe csrss.exe 2292 2400 WerFault.exe lkfnWLCqL4ZUGsjdaeF4rorE.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
pub2.exepRmH8et_SYzCYFyFeXuTEzdT.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pRmH8et_SYzCYFyFeXuTEzdT.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pRmH8et_SYzCYFyFeXuTEzdT.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pRmH8et_SYzCYFyFeXuTEzdT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 4900 schtasks.exe 5040 schtasks.exe 1980 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
WerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 760 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
Graphics.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" Graphics.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" Graphics.exe -
Processes:
File.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 File.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e File.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pub2.exejfiag3g_gg.exeWerFault.exepid process 2424 pub2.exe 2424 pub2.exe 4328 jfiag3g_gg.exe 4328 jfiag3g_gg.exe 4424 WerFault.exe 4424 WerFault.exe 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 1164 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1164 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
pub2.exepRmH8et_SYzCYFyFeXuTEzdT.exepid process 2424 pub2.exe 3008 pRmH8et_SYzCYFyFeXuTEzdT.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
SoCleanInst.exeInstall.exetaskkill.exeWerFault.exemd9_1sjm.exedescription pid process Token: SeDebugPrivilege 1288 SoCleanInst.exe Token: SeCreateTokenPrivilege 3012 Install.exe Token: SeAssignPrimaryTokenPrivilege 3012 Install.exe Token: SeLockMemoryPrivilege 3012 Install.exe Token: SeIncreaseQuotaPrivilege 3012 Install.exe Token: SeMachineAccountPrivilege 3012 Install.exe Token: SeTcbPrivilege 3012 Install.exe Token: SeSecurityPrivilege 3012 Install.exe Token: SeTakeOwnershipPrivilege 3012 Install.exe Token: SeLoadDriverPrivilege 3012 Install.exe Token: SeSystemProfilePrivilege 3012 Install.exe Token: SeSystemtimePrivilege 3012 Install.exe Token: SeProfSingleProcessPrivilege 3012 Install.exe Token: SeIncBasePriorityPrivilege 3012 Install.exe Token: SeCreatePagefilePrivilege 3012 Install.exe Token: SeCreatePermanentPrivilege 3012 Install.exe Token: SeBackupPrivilege 3012 Install.exe Token: SeRestorePrivilege 3012 Install.exe Token: SeShutdownPrivilege 3012 Install.exe Token: SeDebugPrivilege 3012 Install.exe Token: SeAuditPrivilege 3012 Install.exe Token: SeSystemEnvironmentPrivilege 3012 Install.exe Token: SeChangeNotifyPrivilege 3012 Install.exe Token: SeRemoteShutdownPrivilege 3012 Install.exe Token: SeUndockPrivilege 3012 Install.exe Token: SeSyncAgentPrivilege 3012 Install.exe Token: SeEnableDelegationPrivilege 3012 Install.exe Token: SeManageVolumePrivilege 3012 Install.exe Token: SeImpersonatePrivilege 3012 Install.exe Token: SeCreateGlobalPrivilege 3012 Install.exe Token: 31 3012 Install.exe Token: 32 3012 Install.exe Token: 33 3012 Install.exe Token: 34 3012 Install.exe Token: 35 3012 Install.exe Token: SeDebugPrivilege 760 taskkill.exe Token: SeRestorePrivilege 4424 WerFault.exe Token: SeBackupPrivilege 4424 WerFault.exe Token: SeBackupPrivilege 4424 WerFault.exe Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeManageVolumePrivilege 2656 md9_1sjm.exe Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 Token: SeShutdownPrivilege 1164 Token: SeCreatePagefilePrivilege 1164 -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
7_SDYekGsHoS8d1c7vPR5Bmm.exeC7UZW7dKXM1y8UR34SCgRcqo.exeNUwzeMQMokiSYVn30rwebVX9.exeVH59X1iYz5T2RQBDDWqoBZq8.exeDcygT3Ys1XLInSQIvTG_Ey6r.exePt5JF01qRQN1iLv88FJVnzdK.exe03FkcmZZIUb_ezYCj2Qnl5il.exepRmH8et_SYzCYFyFeXuTEzdT.exenbmdzEHGf_l1ZAQ4nMMmglHF.exe_w2mF1YHUi2pPiO04GKPZfQp.exe1z6_khELf8T9X1MoDokR7uNw.exemRv2cz2G0lSBxFNl9cubTIYk.exeNSE9Ld6kxxyuP8DqLvBpj6PI.exenpdc5s5oPJorTBfKBBCgMyzp.exeGUmg4Qa4m1mIsXVgQHVxEcuJ.exeaJdKnzScVDAxGyjD3LZQHLcJ.exetGSr8Ot94Hwai4UWR8xhAPJ2.exeoG1dHne1fWPF3Po8OykVbTuX.exenbmdzEHGf_l1ZAQ4nMMmglHF.exepid process 4852 7_SDYekGsHoS8d1c7vPR5Bmm.exe 1316 C7UZW7dKXM1y8UR34SCgRcqo.exe 428 NUwzeMQMokiSYVn30rwebVX9.exe 4912 VH59X1iYz5T2RQBDDWqoBZq8.exe 4080 DcygT3Ys1XLInSQIvTG_Ey6r.exe 3460 Pt5JF01qRQN1iLv88FJVnzdK.exe 2212 03FkcmZZIUb_ezYCj2Qnl5il.exe 3568 pRmH8et_SYzCYFyFeXuTEzdT.exe 2264 nbmdzEHGf_l1ZAQ4nMMmglHF.exe 1588 _w2mF1YHUi2pPiO04GKPZfQp.exe 3180 1z6_khELf8T9X1MoDokR7uNw.exe 3564 mRv2cz2G0lSBxFNl9cubTIYk.exe 760 NSE9Ld6kxxyuP8DqLvBpj6PI.exe 2152 npdc5s5oPJorTBfKBBCgMyzp.exe 3324 GUmg4Qa4m1mIsXVgQHVxEcuJ.exe 1244 aJdKnzScVDAxGyjD3LZQHLcJ.exe 204 tGSr8Ot94Hwai4UWR8xhAPJ2.exe 2564 oG1dHne1fWPF3Po8OykVbTuX.exe 4484 nbmdzEHGf_l1ZAQ4nMMmglHF.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exeFolder.exeFiles.exeInstall.exerUNdlL32.eXecmd.exeWerFault.exesvchost.exeGraphics.execmd.exeFile.execsrss.exedescription pid process target process PID 4900 wrote to memory of 1288 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe SoCleanInst.exe PID 4900 wrote to memory of 1288 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe SoCleanInst.exe PID 4900 wrote to memory of 2656 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe md9_1sjm.exe PID 4900 wrote to memory of 2656 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe md9_1sjm.exe PID 4900 wrote to memory of 2656 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe md9_1sjm.exe PID 4900 wrote to memory of 1500 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Folder.exe PID 4900 wrote to memory of 1500 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Folder.exe PID 4900 wrote to memory of 1500 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Folder.exe PID 4900 wrote to memory of 4332 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Graphics.exe PID 4900 wrote to memory of 4332 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Graphics.exe PID 4900 wrote to memory of 4332 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Graphics.exe PID 4900 wrote to memory of 360 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Updbdate.exe PID 4900 wrote to memory of 360 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Updbdate.exe PID 4900 wrote to memory of 360 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Updbdate.exe PID 4900 wrote to memory of 3012 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Install.exe PID 4900 wrote to memory of 3012 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Install.exe PID 4900 wrote to memory of 3012 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Install.exe PID 4900 wrote to memory of 3436 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Files.exe PID 4900 wrote to memory of 3436 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Files.exe PID 4900 wrote to memory of 3436 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe Files.exe PID 1500 wrote to memory of 4784 1500 Folder.exe Folder.exe PID 1500 wrote to memory of 4784 1500 Folder.exe Folder.exe PID 1500 wrote to memory of 4784 1500 Folder.exe Folder.exe PID 4900 wrote to memory of 2424 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe pub2.exe PID 4900 wrote to memory of 2424 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe pub2.exe PID 4900 wrote to memory of 2424 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe pub2.exe PID 4900 wrote to memory of 424 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe File.exe PID 4900 wrote to memory of 424 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe File.exe PID 4900 wrote to memory of 424 4900 15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe File.exe PID 3436 wrote to memory of 4088 3436 Files.exe jfiag3g_gg.exe PID 3436 wrote to memory of 4088 3436 Files.exe jfiag3g_gg.exe PID 3436 wrote to memory of 4088 3436 Files.exe jfiag3g_gg.exe PID 3012 wrote to memory of 4180 3012 Install.exe cmd.exe PID 3012 wrote to memory of 4180 3012 Install.exe cmd.exe PID 3012 wrote to memory of 4180 3012 Install.exe cmd.exe PID 4844 wrote to memory of 1540 4844 rUNdlL32.eXe rundll32.exe PID 4844 wrote to memory of 1540 4844 rUNdlL32.eXe rundll32.exe PID 4844 wrote to memory of 1540 4844 rUNdlL32.eXe rundll32.exe PID 4180 wrote to memory of 760 4180 cmd.exe taskkill.exe PID 4180 wrote to memory of 760 4180 cmd.exe taskkill.exe PID 4180 wrote to memory of 760 4180 cmd.exe taskkill.exe PID 2264 wrote to memory of 1540 2264 WerFault.exe rundll32.exe PID 2264 wrote to memory of 1540 2264 WerFault.exe rundll32.exe PID 3436 wrote to memory of 4328 3436 Files.exe jfiag3g_gg.exe PID 3436 wrote to memory of 4328 3436 Files.exe jfiag3g_gg.exe PID 3436 wrote to memory of 4328 3436 Files.exe jfiag3g_gg.exe PID 4712 wrote to memory of 2536 4712 svchost.exe Graphics.exe PID 4712 wrote to memory of 2536 4712 svchost.exe Graphics.exe PID 4712 wrote to memory of 2536 4712 svchost.exe Graphics.exe PID 2536 wrote to memory of 5060 2536 Graphics.exe cmd.exe PID 2536 wrote to memory of 5060 2536 Graphics.exe cmd.exe PID 5060 wrote to memory of 444 5060 cmd.exe netsh.exe PID 5060 wrote to memory of 444 5060 cmd.exe netsh.exe PID 2536 wrote to memory of 3032 2536 Graphics.exe csrss.exe PID 2536 wrote to memory of 3032 2536 Graphics.exe csrss.exe PID 2536 wrote to memory of 3032 2536 Graphics.exe csrss.exe PID 4712 wrote to memory of 4900 4712 svchost.exe schtasks.exe PID 4712 wrote to memory of 4900 4712 svchost.exe schtasks.exe PID 424 wrote to memory of 4292 424 File.exe KRJJGGZUDBIGnUiuMhFVCYhb.exe PID 424 wrote to memory of 4292 424 File.exe KRJJGGZUDBIGnUiuMhFVCYhb.exe PID 3032 wrote to memory of 1960 3032 csrss.exe injector.exe PID 3032 wrote to memory of 1960 3032 csrss.exe injector.exe PID 424 wrote to memory of 4852 424 File.exe 7_SDYekGsHoS8d1c7vPR5Bmm.exe PID 424 wrote to memory of 4852 424 File.exe 7_SDYekGsHoS8d1c7vPR5Bmm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe"C:\Users\Admin\AppData\Local\Temp\15927cd90056342bc7e695c22dbd72a61596f26deb93b1db9c4c9812a08d0daf.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exe"C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exe"C:\Users\Admin\AppData\Local\Temp\Graphics.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 3283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 3363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 3483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 7283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 7363⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 7523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 8083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 8883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 9003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 8603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 9243⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 9443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 7883⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 9523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 9403⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 8243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exe"C:\Users\Admin\AppData\Local\Temp\Graphics.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 2924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 2964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 2964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 4284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 6684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 6684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 7004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 7084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 7244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 8484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 8604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 8964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 7244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 8644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 9004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 8844⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /202-2024⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 3285⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 3325⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 3285⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 6645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 6645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 6645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 6645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7525⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7485⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 6205⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 6805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7805⤵
- Program crash
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 7805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 9845⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 9965⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 9565⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 10045⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 10605⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 10365⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 10965⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 9645⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 9485⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 9645⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"C:\Users\Admin\AppData\Local\Temp\Updbdate.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\KRJJGGZUDBIGnUiuMhFVCYhb.exe"C:\Users\Admin\Pictures\Adobe Films\KRJJGGZUDBIGnUiuMhFVCYhb.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\7_SDYekGsHoS8d1c7vPR5Bmm.exe"C:\Users\Admin\Pictures\Adobe Films\7_SDYekGsHoS8d1c7vPR5Bmm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\lkfnWLCqL4ZUGsjdaeF4rorE.exe"C:\Users\Admin\Pictures\Adobe Films\lkfnWLCqL4ZUGsjdaeF4rorE.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 4244⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\VH59X1iYz5T2RQBDDWqoBZq8.exe"C:\Users\Admin\Pictures\Adobe Films\VH59X1iYz5T2RQBDDWqoBZq8.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bsbkrdsu\4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pcuqcvy.exe" C:\Windows\SysWOW64\bsbkrdsu\4⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create bsbkrdsu binPath= "C:\Windows\SysWOW64\bsbkrdsu\pcuqcvy.exe /d\"C:\Users\Admin\Pictures\Adobe Films\VH59X1iYz5T2RQBDDWqoBZq8.exe\"" type= own start= auto DisplayName= "wifi support"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\DcygT3Ys1XLInSQIvTG_Ey6r.exe"C:\Users\Admin\Pictures\Adobe Films\DcygT3Ys1XLInSQIvTG_Ey6r.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS75F4.tmp\Install.exe.\Install.exe4⤵
-
C:\Users\Admin\Pictures\Adobe Films\NUwzeMQMokiSYVn30rwebVX9.exe"C:\Users\Admin\Pictures\Adobe Films\NUwzeMQMokiSYVn30rwebVX9.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\C7UZW7dKXM1y8UR34SCgRcqo.exe"C:\Users\Admin\Pictures\Adobe Films\C7UZW7dKXM1y8UR34SCgRcqo.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\tGSr8Ot94Hwai4UWR8xhAPJ2.exe"C:\Users\Admin\Documents\tGSr8Ot94Hwai4UWR8xhAPJ2.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\CssUvbj98unQXFuyFr8speZw.exe"C:\Users\Admin\Pictures\Adobe Films\CssUvbj98unQXFuyFr8speZw.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\sW6yBfbMVK33sD3kzI4xIvrl.exe"C:\Users\Admin\Pictures\Adobe Films\sW6yBfbMVK33sD3kzI4xIvrl.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\e00iiKWflGUeFoFf7rp6cV2_.exe"C:\Users\Admin\Pictures\Adobe Films\e00iiKWflGUeFoFf7rp6cV2_.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\gp2fgAa9GZbkz7UEyQVAFgwQ.exe"C:\Users\Admin\Pictures\Adobe Films\gp2fgAa9GZbkz7UEyQVAFgwQ.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\pRmH8et_SYzCYFyFeXuTEzdT.exe"C:\Users\Admin\Pictures\Adobe Films\pRmH8et_SYzCYFyFeXuTEzdT.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\pRmH8et_SYzCYFyFeXuTEzdT.exe"C:\Users\Admin\Pictures\Adobe Films\pRmH8et_SYzCYFyFeXuTEzdT.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\03FkcmZZIUb_ezYCj2Qnl5il.exe"C:\Users\Admin\Pictures\Adobe Films\03FkcmZZIUb_ezYCj2Qnl5il.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\Pt5JF01qRQN1iLv88FJVnzdK.exe"C:\Users\Admin\Pictures\Adobe Films\Pt5JF01qRQN1iLv88FJVnzdK.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\_w2mF1YHUi2pPiO04GKPZfQp.exe"C:\Users\Admin\Pictures\Adobe Films\_w2mF1YHUi2pPiO04GKPZfQp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\nbmdzEHGf_l1ZAQ4nMMmglHF.exe"C:\Users\Admin\Pictures\Adobe Films\nbmdzEHGf_l1ZAQ4nMMmglHF.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\nbmdzEHGf_l1ZAQ4nMMmglHF.exe"C:\Users\Admin\Pictures\Adobe Films\nbmdzEHGf_l1ZAQ4nMMmglHF.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\NSE9Ld6kxxyuP8DqLvBpj6PI.exe"C:\Users\Admin\Pictures\Adobe Films\NSE9Ld6kxxyuP8DqLvBpj6PI.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\npdc5s5oPJorTBfKBBCgMyzp.exe"C:\Users\Admin\Pictures\Adobe Films\npdc5s5oPJorTBfKBBCgMyzp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 4644⤵
-
C:\Users\Admin\Pictures\Adobe Films\mRv2cz2G0lSBxFNl9cubTIYk.exe"C:\Users\Admin\Pictures\Adobe Films\mRv2cz2G0lSBxFNl9cubTIYk.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla4⤵
-
C:\Users\Admin\Pictures\Adobe Films\GUmg4Qa4m1mIsXVgQHVxEcuJ.exe"C:\Users\Admin\Pictures\Adobe Films\GUmg4Qa4m1mIsXVgQHVxEcuJ.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3324 -s 4644⤵
-
C:\Users\Admin\Pictures\Adobe Films\1z6_khELf8T9X1MoDokR7uNw.exe"C:\Users\Admin\Pictures\Adobe Films\1z6_khELf8T9X1MoDokR7uNw.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\aJdKnzScVDAxGyjD3LZQHLcJ.exe"C:\Users\Admin\Pictures\Adobe Films\aJdKnzScVDAxGyjD3LZQHLcJ.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 4724⤵
-
C:\Users\Admin\Pictures\Adobe Films\oG1dHne1fWPF3Po8OykVbTuX.exe"C:\Users\Admin\Pictures\Adobe Films\oG1dHne1fWPF3Po8OykVbTuX.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\ABD9J.exe"C:\Users\Admin\AppData\Local\Temp\ABD9J.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\LLCLJ.exe"C:\Users\Admin\AppData\Local\Temp\LLCLJ.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\50932.exe"C:\Users\Admin\AppData\Local\Temp\50932.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\8JICG.exe"C:\Users\Admin\AppData\Local\Temp\8JICG.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4332 -ip 43321⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 6003⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1540 -ip 15401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4332 -ip 43321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4332 -ip 43321⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2536 -ip 25361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2400 -ip 24001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1244 -ip 12441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3324 -ip 33241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2152 -ip 21521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4852 -ip 48521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4852 -ip 48521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4852 -ip 48521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4852 -ip 48521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2264 -ip 22641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
f8f1ccfd1f5ab074cc2d646fd6e3ab8d
SHA1c4d0de340689af5b2f449301034aac7079d8d0b4
SHA2564845fab514f78529ec4d35e0e5716a6e180b4594519003cf8ae669d1534a1db6
SHA5120f09aabc5d333a09bd6b90ebe667f06f4c72e115f66c73bf06865db93ed7f07ccb5627b10e27ee68b8f0b1222ad7bcaa119625bcb31426113386947d58c0cf74
-
C:\Users\Admin\AppData\Local\Temp\File.exeMD5
c9f445ba47d43aba67caf6020c2390d3
SHA103180d69fa4b26edbe627e2691df38882eab03b0
SHA256acc70eb94782931ab5f817a91b3c4cedf4c3077fb497a63e90a55e500da7676e
SHA5128c1e34f04f84fa00b58499c8ee986ebef15ba015021831ee4582f8d0c2347192c9b1d6f15211bc7c9490e268066801f35565b8d85ab07796a06937b5cf4ac141
-
C:\Users\Admin\AppData\Local\Temp\File.exeMD5
c9f445ba47d43aba67caf6020c2390d3
SHA103180d69fa4b26edbe627e2691df38882eab03b0
SHA256acc70eb94782931ab5f817a91b3c4cedf4c3077fb497a63e90a55e500da7676e
SHA5128c1e34f04f84fa00b58499c8ee986ebef15ba015021831ee4582f8d0c2347192c9b1d6f15211bc7c9490e268066801f35565b8d85ab07796a06937b5cf4ac141
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
2d0217e0c70440d8c82883eadea517b9
SHA1f3b7dd6dbb43b895ba26f67370af99952b7d83cb
SHA256d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01
SHA5126d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
2d0217e0c70440d8c82883eadea517b9
SHA1f3b7dd6dbb43b895ba26f67370af99952b7d83cb
SHA256d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01
SHA5126d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exeMD5
907b8a8bacc5432518151b830339539d
SHA19d5a934d1291db04f88482e2c3e5f3053552e044
SHA25661727c9ed9fc3b1f5c4a093ec2c117267b98123939766648c4eda1ea2a83aa3f
SHA5128129c626287277957d07714000f854c20271b4c7a1990431aa41a86b9152000e50b8ffd3cddf8ceb6c78f7ab2b17135fbee115d259964970f854ea6416f0f622
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exeMD5
907b8a8bacc5432518151b830339539d
SHA19d5a934d1291db04f88482e2c3e5f3053552e044
SHA25661727c9ed9fc3b1f5c4a093ec2c117267b98123939766648c4eda1ea2a83aa3f
SHA5128129c626287277957d07714000f854c20271b4c7a1990431aa41a86b9152000e50b8ffd3cddf8ceb6c78f7ab2b17135fbee115d259964970f854ea6416f0f622
-
C:\Users\Admin\AppData\Local\Temp\Graphics.exeMD5
907b8a8bacc5432518151b830339539d
SHA19d5a934d1291db04f88482e2c3e5f3053552e044
SHA25661727c9ed9fc3b1f5c4a093ec2c117267b98123939766648c4eda1ea2a83aa3f
SHA5128129c626287277957d07714000f854c20271b4c7a1990431aa41a86b9152000e50b8ffd3cddf8ceb6c78f7ab2b17135fbee115d259964970f854ea6416f0f622
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
921b10ea055eb9c80737b07142de6d2e
SHA16c2134159e68c8219a51a5b4dab4da33f2e0bad1
SHA256f9f6ec4585db7b9e410b685e38f54db289671955dc39ab14a904745418a21350
SHA51280ae017b10e0ae9190b409efb667891f8c747ec34b236b5fd34e2f8c144da439f237480acc9b44673a82ea8c9ae7c3e3f18bdafc879b6753566ec0615f310130
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
921b10ea055eb9c80737b07142de6d2e
SHA16c2134159e68c8219a51a5b4dab4da33f2e0bad1
SHA256f9f6ec4585db7b9e410b685e38f54db289671955dc39ab14a904745418a21350
SHA51280ae017b10e0ae9190b409efb667891f8c747ec34b236b5fd34e2f8c144da439f237480acc9b44673a82ea8c9ae7c3e3f18bdafc879b6753566ec0615f310130
-
C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exeMD5
8d3cfb11fd739e8129dd2aa9ce026945
SHA1d39e2cf1b55fcee6cfd65ccc084d2aa92e603f40
SHA256ed0c0bb267a6b40646eb5383155314326c99bfe1dccda529b12db14c37c57616
SHA512ea80e3fa4bc6b232d025b03c29758ea17641df0f16939c839f5d024a23f69b0453c49a72d8eda3571999f970e7f074f1c7b96b50478bd0b7c3c623886cc985ef
-
C:\Users\Admin\AppData\Local\Temp\SoCleanInst.exeMD5
8d3cfb11fd739e8129dd2aa9ce026945
SHA1d39e2cf1b55fcee6cfd65ccc084d2aa92e603f40
SHA256ed0c0bb267a6b40646eb5383155314326c99bfe1dccda529b12db14c37c57616
SHA512ea80e3fa4bc6b232d025b03c29758ea17641df0f16939c839f5d024a23f69b0453c49a72d8eda3571999f970e7f074f1c7b96b50478bd0b7c3c623886cc985ef
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exeMD5
f9cf52d7407aa11cd18af2d511d8d25c
SHA1e0cbe234314c53d439fc3b3be68fd7b4956cb09a
SHA256cd1bf677d6b0c6be3038e58ec2d9a26cce637b8804e49d0302878be47a24bb04
SHA5121d7ff1933f1d536358245b083d592552624515962dc9d819baa83f1b5254655f62f1247553d603b4f6b10f8085179ee698c58aa6fc3f396ed498e75991bee965
-
C:\Users\Admin\AppData\Local\Temp\Updbdate.exeMD5
f9cf52d7407aa11cd18af2d511d8d25c
SHA1e0cbe234314c53d439fc3b3be68fd7b4956cb09a
SHA256cd1bf677d6b0c6be3038e58ec2d9a26cce637b8804e49d0302878be47a24bb04
SHA5121d7ff1933f1d536358245b083d592552624515962dc9d819baa83f1b5254655f62f1247553d603b4f6b10f8085179ee698c58aa6fc3f396ed498e75991bee965
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
5fd2eba6df44d23c9e662763009d7f84
SHA143530574f8ac455ae263c70cc99550bc60bfa4f1
SHA2562991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f
SHA512321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeMD5
d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeMD5
d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
4f4f6906ab07d2bf48efdcf836f95f4f
SHA1eaf6b1ace4c40a154149f207cdda87fa9cf07fb2
SHA25658f657ef4204d80a59e576d169d7fe2ea06d4c37fe20fee5470b329a1a72ad02
SHA512d8ede0b77f6b5b801aa137a55c94b5648f9c8b7f80b0e516433226786c3b15d6f750ada597d22591ebf50fb3fc2e75ab17df0693975f0edcd69a1d74f75d6fe2
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeMD5
f250a9c692088cce4253332a205b1649
SHA1109c79124ce2bda06cab50ea5d97294d13d42b20
SHA2560a6c3a23510f93fcdcb6d5acc53ccccbcc51c68f14b1bcbd758ffbf135f8e882
SHA51280553664f188ae35cef1f89d188fb17df8a490367f8d6fa5f9897115bacf776373905bccd599353add684c7fa6c2554d04cbf1a7f6cc87b299d6c51da33c1b5e
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeMD5
f250a9c692088cce4253332a205b1649
SHA1109c79124ce2bda06cab50ea5d97294d13d42b20
SHA2560a6c3a23510f93fcdcb6d5acc53ccccbcc51c68f14b1bcbd758ffbf135f8e882
SHA51280553664f188ae35cef1f89d188fb17df8a490367f8d6fa5f9897115bacf776373905bccd599353add684c7fa6c2554d04cbf1a7f6cc87b299d6c51da33c1b5e
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
a101a68eb9b038c745b9110ea35e4357
SHA1c2d6b37ef2b38de4e77932eb3df856b798c4573a
SHA2560aaa53d370cb72e8f9b0936ba6cdd0028baf761878aac03fe11f186fb422b5c3
SHA5122f46dbf2e3ef13d54327550fddbe139b3cf6b65653d429906b4627fea798e7750c0a02a539754befd05b201a07dc533868800362a80bfe68fa075e9fcafcbdf6
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
a101a68eb9b038c745b9110ea35e4357
SHA1c2d6b37ef2b38de4e77932eb3df856b798c4573a
SHA2560aaa53d370cb72e8f9b0936ba6cdd0028baf761878aac03fe11f186fb422b5c3
SHA5122f46dbf2e3ef13d54327550fddbe139b3cf6b65653d429906b4627fea798e7750c0a02a539754befd05b201a07dc533868800362a80bfe68fa075e9fcafcbdf6
-
C:\Users\Admin\Pictures\Adobe Films\03FkcmZZIUb_ezYCj2Qnl5il.exeMD5
89d23a186c49efb69750227d23674b48
SHA1221e7b4682805e23cbb54c2d9d687408467f164b
SHA256605e1096b60089c456e10be716364cf051d6409ac82d69f128594eb92b66d0db
SHA5123cbcb52e9be11997c33cd5065705ecb35a8557f930cac0057648055958b0020b3f6edd45af6b878cca7191d5ebfbbfeaafa1b72427d5566a8bd47dc437d9cd64
-
C:\Users\Admin\Pictures\Adobe Films\03FkcmZZIUb_ezYCj2Qnl5il.exeMD5
89d23a186c49efb69750227d23674b48
SHA1221e7b4682805e23cbb54c2d9d687408467f164b
SHA256605e1096b60089c456e10be716364cf051d6409ac82d69f128594eb92b66d0db
SHA5123cbcb52e9be11997c33cd5065705ecb35a8557f930cac0057648055958b0020b3f6edd45af6b878cca7191d5ebfbbfeaafa1b72427d5566a8bd47dc437d9cd64
-
C:\Users\Admin\Pictures\Adobe Films\7_SDYekGsHoS8d1c7vPR5Bmm.exeMD5
1c98778c8a84ccff1e053e8ca3b5d07c
SHA16271555b2e5afdea9b34c4a57503d7e6f140deb0
SHA256261568b0fc903d0ee4cbe7db03549f8bd4d5c3e8f4704dd41d2d58a0ea8b19f0
SHA512584aeb46e933c38211203a211f88c6a44bada3e3cc938dc61fe1704b049216efdad2524868a9bdd01561c345f6667ec03b3b82188fe8dddecef22dc53eb2c3aa
-
C:\Users\Admin\Pictures\Adobe Films\7_SDYekGsHoS8d1c7vPR5Bmm.exeMD5
1c98778c8a84ccff1e053e8ca3b5d07c
SHA16271555b2e5afdea9b34c4a57503d7e6f140deb0
SHA256261568b0fc903d0ee4cbe7db03549f8bd4d5c3e8f4704dd41d2d58a0ea8b19f0
SHA512584aeb46e933c38211203a211f88c6a44bada3e3cc938dc61fe1704b049216efdad2524868a9bdd01561c345f6667ec03b3b82188fe8dddecef22dc53eb2c3aa
-
C:\Users\Admin\Pictures\Adobe Films\C7UZW7dKXM1y8UR34SCgRcqo.exeMD5
dabae535097a94f593d5afad04acd5ea
SHA1389a64c4e8c1601fba56576ee261fc953b53ae96
SHA256e0a33241f5c4ac8f304af0387ddc54da264c0a5101c822d0fc71b10af947b391
SHA5129846f4529b94b251ed21c9ae0e47ab19814973f62fbf082db845c9c484e79cd9de2523a4471426e721b698ba4a296eb233544035d66ef373c14bdda718730d05
-
C:\Users\Admin\Pictures\Adobe Films\C7UZW7dKXM1y8UR34SCgRcqo.exeMD5
dabae535097a94f593d5afad04acd5ea
SHA1389a64c4e8c1601fba56576ee261fc953b53ae96
SHA256e0a33241f5c4ac8f304af0387ddc54da264c0a5101c822d0fc71b10af947b391
SHA5129846f4529b94b251ed21c9ae0e47ab19814973f62fbf082db845c9c484e79cd9de2523a4471426e721b698ba4a296eb233544035d66ef373c14bdda718730d05
-
C:\Users\Admin\Pictures\Adobe Films\DcygT3Ys1XLInSQIvTG_Ey6r.exeMD5
f5679d1dd9ad96356b75f940d72eada0
SHA121c765aa24d0d359b8bbf721f5d8a328eabd616a
SHA256970b7721edc89b2f0baff45d90296cb0dd892776d2102c8f498de9fc5c61db8b
SHA512f83341934aa4a2d989eef81533337d98e4d9329dd0bb9659de0edb2ade8838e9f3496f2e1b9bc4d323322356a8ab586866999f43c4a4af89a3ed09b8c84c8a5c
-
C:\Users\Admin\Pictures\Adobe Films\DcygT3Ys1XLInSQIvTG_Ey6r.exeMD5
f5679d1dd9ad96356b75f940d72eada0
SHA121c765aa24d0d359b8bbf721f5d8a328eabd616a
SHA256970b7721edc89b2f0baff45d90296cb0dd892776d2102c8f498de9fc5c61db8b
SHA512f83341934aa4a2d989eef81533337d98e4d9329dd0bb9659de0edb2ade8838e9f3496f2e1b9bc4d323322356a8ab586866999f43c4a4af89a3ed09b8c84c8a5c
-
C:\Users\Admin\Pictures\Adobe Films\KRJJGGZUDBIGnUiuMhFVCYhb.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\KRJJGGZUDBIGnUiuMhFVCYhb.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\NUwzeMQMokiSYVn30rwebVX9.exeMD5
eb2f1ba27d4ae055595e5d7c173b02ea
SHA195489360dc43f942b755f053565866ab4d0f0c7b
SHA256fa88c86ff21e12477257ab657bd85c6dfa38982bff1493e5e162a5cc518c4440
SHA512776ce93c19e3affa21f830b30035049c9e2bfe59b62b88a3607b46221a36d39dcc8a5d2a4637ff2d2b91efe4e8530d492d51ab1eafd34d38ad5ffaa67aa9df39
-
C:\Users\Admin\Pictures\Adobe Films\NUwzeMQMokiSYVn30rwebVX9.exeMD5
eb2f1ba27d4ae055595e5d7c173b02ea
SHA195489360dc43f942b755f053565866ab4d0f0c7b
SHA256fa88c86ff21e12477257ab657bd85c6dfa38982bff1493e5e162a5cc518c4440
SHA512776ce93c19e3affa21f830b30035049c9e2bfe59b62b88a3607b46221a36d39dcc8a5d2a4637ff2d2b91efe4e8530d492d51ab1eafd34d38ad5ffaa67aa9df39
-
C:\Users\Admin\Pictures\Adobe Films\Pt5JF01qRQN1iLv88FJVnzdK.exeMD5
b9b15774905815d1ab124662adbaca9f
SHA121becde5109bac48f3efd8b4fea7043c47daf563
SHA256655c8da705475f8326a43a382036964a2ecb3d39923154a2db8a0ac18e191934
SHA512b9b9bbe177aac7b261c9632bc30338e747acf38bc4b7b74d8db0d3f0ccfe7f4bc44182bf660f94fdc88ee542a7d595b10f44d9ad1eb22c12d255369281a77e31
-
C:\Users\Admin\Pictures\Adobe Films\Pt5JF01qRQN1iLv88FJVnzdK.exeMD5
b9b15774905815d1ab124662adbaca9f
SHA121becde5109bac48f3efd8b4fea7043c47daf563
SHA256655c8da705475f8326a43a382036964a2ecb3d39923154a2db8a0ac18e191934
SHA512b9b9bbe177aac7b261c9632bc30338e747acf38bc4b7b74d8db0d3f0ccfe7f4bc44182bf660f94fdc88ee542a7d595b10f44d9ad1eb22c12d255369281a77e31
-
C:\Users\Admin\Pictures\Adobe Films\VH59X1iYz5T2RQBDDWqoBZq8.exeMD5
caf7eb755bd0348b0ca5a03fe50df495
SHA1d4e6e8a7a2c9524a287339e445ebd7061a292b28
SHA2560342010025423b0f608bd3466e05c1e7967a7357ee4847fab8b23d8e329a8abb
SHA5121d722df99ca31d2ba491ee086b8cbfc966f005ee0c2dceb42978fc8fe7d5ab143993bd3840c9178fce82aae5164285d08d07a60fa4e277307c2729bf482e2e5b
-
C:\Users\Admin\Pictures\Adobe Films\VH59X1iYz5T2RQBDDWqoBZq8.exeMD5
caf7eb755bd0348b0ca5a03fe50df495
SHA1d4e6e8a7a2c9524a287339e445ebd7061a292b28
SHA2560342010025423b0f608bd3466e05c1e7967a7357ee4847fab8b23d8e329a8abb
SHA5121d722df99ca31d2ba491ee086b8cbfc966f005ee0c2dceb42978fc8fe7d5ab143993bd3840c9178fce82aae5164285d08d07a60fa4e277307c2729bf482e2e5b
-
C:\Users\Admin\Pictures\Adobe Films\_w2mF1YHUi2pPiO04GKPZfQp.exeMD5
a1c4d1ce68ceaffa84728ed0f5196fd0
SHA1f6941f577550a6ecf5309582968ea2c4c12fa7d7
SHA256b940e318153e9cb75af0195676bbaeb136804963eba07ab277b0f7238e426b9a
SHA5120854320417e360b23bb0f49ac3367e1853fbfdf6f0c87ae9614de46dd466090fea8849b177f6bfba5e1865cc0b4450b6fb13b58377cef1018da364f9aec93766
-
C:\Users\Admin\Pictures\Adobe Films\aJdKnzScVDAxGyjD3LZQHLcJ.exeMD5
d0e66302d8fd5c0987670667702e844d
SHA1e232dcbb280b2fcc09060d5f0c1c95d8751bd308
SHA2563053835dc6474fabe8979800bd984c6f234b1e94571614f9475e2c7ee5e843f8
SHA5129891b4a5378a4c7a501f4de3e84af7d46075ee21e2835a75691b9ab61350695fdd7c9a5317efb67e8c025b5f48bc6d02545f205f7ba32a46245969cafeb3fdab
-
C:\Users\Admin\Pictures\Adobe Films\e00iiKWflGUeFoFf7rp6cV2_.exeMD5
6817e893a00b534fb3d936a2a16da2b1
SHA1b91f5ff23a27cfda0f57e788913942183ce45772
SHA256e53845a73c55f86fe6fc276f97bfeb8b366bf1e7b8cb72e55fc8472362ab7c5c
SHA512c174e4b31f4742c764a9fd25bad12ed35aa941d6ac0ece9bfb90767f890d9520eebf78e83c40a68274ca0f8987fd0574856b8975aab8160ec3fb4690f78b54db
-
C:\Users\Admin\Pictures\Adobe Films\e00iiKWflGUeFoFf7rp6cV2_.exeMD5
6817e893a00b534fb3d936a2a16da2b1
SHA1b91f5ff23a27cfda0f57e788913942183ce45772
SHA256e53845a73c55f86fe6fc276f97bfeb8b366bf1e7b8cb72e55fc8472362ab7c5c
SHA512c174e4b31f4742c764a9fd25bad12ed35aa941d6ac0ece9bfb90767f890d9520eebf78e83c40a68274ca0f8987fd0574856b8975aab8160ec3fb4690f78b54db
-
C:\Users\Admin\Pictures\Adobe Films\gp2fgAa9GZbkz7UEyQVAFgwQ.exeMD5
266a1335f73ff12584a5d1d2e65b8be7
SHA135a6d1593a0ff74f209de0f294cd7b7cd067c14c
SHA256316a7cea264e8cc29efe6dc3def98eeff7c42138ceba126127dc8228a119cfee
SHA51235bdc71211656abaf05cde978594b5d0ad11d154851d90adc80fb96e1c737682561e82615024453bf6f483cb7bf451bd604993343e3bfb2d369deef25d1e4361
-
C:\Users\Admin\Pictures\Adobe Films\gp2fgAa9GZbkz7UEyQVAFgwQ.exeMD5
266a1335f73ff12584a5d1d2e65b8be7
SHA135a6d1593a0ff74f209de0f294cd7b7cd067c14c
SHA256316a7cea264e8cc29efe6dc3def98eeff7c42138ceba126127dc8228a119cfee
SHA51235bdc71211656abaf05cde978594b5d0ad11d154851d90adc80fb96e1c737682561e82615024453bf6f483cb7bf451bd604993343e3bfb2d369deef25d1e4361
-
C:\Users\Admin\Pictures\Adobe Films\lkfnWLCqL4ZUGsjdaeF4rorE.exeMD5
c4729b22af5fddb503601f0819709e32
SHA10d27d046eb78c188c1eccfd1d0654a8262d97aab
SHA256fb2b6caaeb56477df79dc728f7e4f5547f2c29d9bbf1d4c230da23c5603f22b4
SHA51283d434b1e6265097462807536811dae19f9fb7c3760bff11e6da7715208846f4d06c5aec6434ff9159be7e8ec8b0bebac8de9d58a490fe13312ab1f81aaef4c0
-
C:\Users\Admin\Pictures\Adobe Films\lkfnWLCqL4ZUGsjdaeF4rorE.exeMD5
c4729b22af5fddb503601f0819709e32
SHA10d27d046eb78c188c1eccfd1d0654a8262d97aab
SHA256fb2b6caaeb56477df79dc728f7e4f5547f2c29d9bbf1d4c230da23c5603f22b4
SHA51283d434b1e6265097462807536811dae19f9fb7c3760bff11e6da7715208846f4d06c5aec6434ff9159be7e8ec8b0bebac8de9d58a490fe13312ab1f81aaef4c0
-
C:\Users\Admin\Pictures\Adobe Films\nbmdzEHGf_l1ZAQ4nMMmglHF.exeMD5
4cb40a5915b998c9c70b71e6b54de912
SHA115bfedc171add539bcbb2ecf4a1fd9eef1fd97f9
SHA256bcba37ea39dbe60b1dd38557aaccf5aca3d6e2d754fa6e6d81e07e18ff3d7e58
SHA512945b1de67d1cc6adb9bbbf1b08d8163c1cbb19f6878242def90aa08354503d98c96e7b53218ef4c1024c1315c3361be59830cbc88308b4ea088d1efe3755ebad
-
C:\Users\Admin\Pictures\Adobe Films\pRmH8et_SYzCYFyFeXuTEzdT.exeMD5
ebd92ae870a96ec9eafc5e12b22d0caa
SHA1a000562844a49fe6c226d74ef23b7ffef7f7ed10
SHA256bf3cb3479ba2238dda49a220bfa875b399a3e37149e29a2d5762bf81f43276c7
SHA5125c5ed2b131818dabb7c5a47a2f4a3631ae0c11b577d34dc208bb5a0c3a2c6d8dbc1d74920b899082b31f27c51e73b969fe7c0fc68ec83b5b294565082440d301
-
C:\Users\Admin\Pictures\Adobe Films\pRmH8et_SYzCYFyFeXuTEzdT.exeMD5
ebd92ae870a96ec9eafc5e12b22d0caa
SHA1a000562844a49fe6c226d74ef23b7ffef7f7ed10
SHA256bf3cb3479ba2238dda49a220bfa875b399a3e37149e29a2d5762bf81f43276c7
SHA5125c5ed2b131818dabb7c5a47a2f4a3631ae0c11b577d34dc208bb5a0c3a2c6d8dbc1d74920b899082b31f27c51e73b969fe7c0fc68ec83b5b294565082440d301
-
C:\Users\Admin\Pictures\Adobe Films\sW6yBfbMVK33sD3kzI4xIvrl.exeMD5
c0fe94a584c658026552ae848edbfd84
SHA1507c9ae16bb5bebd5b072f09aa097807bb5665ff
SHA2565340c47a07719d1db92de4786679247876e2aa0197b14fc24a9f7292d0c38880
SHA5128d9f1976ede385f1b51664c9e9b31cbcf1a7f3347ca7794038d88c7d274ee50aa1513f5bd9c0c1974bca2f6982df860bb36886c60a3f59297fe97086d5c3a620
-
C:\Users\Admin\Pictures\Adobe Films\sW6yBfbMVK33sD3kzI4xIvrl.exeMD5
c0fe94a584c658026552ae848edbfd84
SHA1507c9ae16bb5bebd5b072f09aa097807bb5665ff
SHA2565340c47a07719d1db92de4786679247876e2aa0197b14fc24a9f7292d0c38880
SHA5128d9f1976ede385f1b51664c9e9b31cbcf1a7f3347ca7794038d88c7d274ee50aa1513f5bd9c0c1974bca2f6982df860bb36886c60a3f59297fe97086d5c3a620
-
C:\Windows\rss\csrss.exeMD5
907b8a8bacc5432518151b830339539d
SHA19d5a934d1291db04f88482e2c3e5f3053552e044
SHA25661727c9ed9fc3b1f5c4a093ec2c117267b98123939766648c4eda1ea2a83aa3f
SHA5128129c626287277957d07714000f854c20271b4c7a1990431aa41a86b9152000e50b8ffd3cddf8ceb6c78f7ab2b17135fbee115d259964970f854ea6416f0f622
-
C:\Windows\rss\csrss.exeMD5
907b8a8bacc5432518151b830339539d
SHA19d5a934d1291db04f88482e2c3e5f3053552e044
SHA25661727c9ed9fc3b1f5c4a093ec2c117267b98123939766648c4eda1ea2a83aa3f
SHA5128129c626287277957d07714000f854c20271b4c7a1990431aa41a86b9152000e50b8ffd3cddf8ceb6c78f7ab2b17135fbee115d259964970f854ea6416f0f622
-
memory/360-251-0x00000000023F4000-0x0000000002417000-memory.dmpFilesize
140KB
-
memory/360-157-0x0000000006E70000-0x0000000006E82000-memory.dmpFilesize
72KB
-
memory/360-266-0x00000000025F4000-0x00000000025F6000-memory.dmpFilesize
8KB
-
memory/360-253-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/360-263-0x00000000025F0000-0x00000000025F1000-memory.dmpFilesize
4KB
-
memory/360-162-0x0000000006FA0000-0x0000000006FDC000-memory.dmpFilesize
240KB
-
memory/360-159-0x0000000006E90000-0x0000000006F9A000-memory.dmpFilesize
1.0MB
-
memory/360-262-0x00000000717AE000-0x00000000717AF000-memory.dmpFilesize
4KB
-
memory/360-156-0x0000000007470000-0x0000000007A88000-memory.dmpFilesize
6.1MB
-
memory/360-155-0x00000000068A0000-0x0000000006E44000-memory.dmpFilesize
5.6MB
-
memory/360-252-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/360-264-0x00000000025F2000-0x00000000025F3000-memory.dmpFilesize
4KB
-
memory/360-144-0x00000000023F4000-0x0000000002417000-memory.dmpFilesize
140KB
-
memory/360-265-0x00000000025F3000-0x00000000025F4000-memory.dmpFilesize
4KB
-
memory/424-255-0x0000000003CC0000-0x0000000003E7D000-memory.dmpFilesize
1.7MB
-
memory/760-221-0x0000000000980000-0x0000000000B37000-memory.dmpFilesize
1.7MB
-
memory/760-225-0x0000000076920000-0x0000000076B35000-memory.dmpFilesize
2.1MB
-
memory/760-283-0x00000000717AE000-0x00000000717AF000-memory.dmpFilesize
4KB
-
memory/760-275-0x0000000000982000-0x00000000009B7000-memory.dmpFilesize
212KB
-
memory/760-274-0x0000000002F50000-0x0000000002F96000-memory.dmpFilesize
280KB
-
memory/760-278-0x0000000001520000-0x0000000001521000-memory.dmpFilesize
4KB
-
memory/760-228-0x0000000000980000-0x0000000000B37000-memory.dmpFilesize
1.7MB
-
memory/760-301-0x0000000076BF0000-0x00000000771A3000-memory.dmpFilesize
5.7MB
-
memory/760-231-0x0000000074530000-0x00000000745B9000-memory.dmpFilesize
548KB
-
memory/760-220-0x0000000000980000-0x0000000000B37000-memory.dmpFilesize
1.7MB
-
memory/760-230-0x0000000000980000-0x0000000000B37000-memory.dmpFilesize
1.7MB
-
memory/760-223-0x0000000001500000-0x0000000001501000-memory.dmpFilesize
4KB
-
memory/1164-245-0x0000000003270000-0x0000000003285000-memory.dmpFilesize
84KB
-
memory/1288-135-0x00007FF954633000-0x00007FF954635000-memory.dmpFilesize
8KB
-
memory/1288-132-0x0000000000840000-0x0000000000862000-memory.dmpFilesize
136KB
-
memory/1936-286-0x0000000076920000-0x0000000076B35000-memory.dmpFilesize
2.1MB
-
memory/1936-298-0x0000000074530000-0x00000000745B9000-memory.dmpFilesize
548KB
-
memory/1936-281-0x00000000001D2000-0x0000000000207000-memory.dmpFilesize
212KB
-
memory/1936-280-0x00000000001D0000-0x0000000000392000-memory.dmpFilesize
1.8MB
-
memory/1936-303-0x0000000076BF0000-0x00000000771A3000-memory.dmpFilesize
5.7MB
-
memory/1936-282-0x0000000002C20000-0x0000000002C21000-memory.dmpFilesize
4KB
-
memory/1936-277-0x0000000002CA0000-0x0000000002CE6000-memory.dmpFilesize
280KB
-
memory/2152-284-0x0000000000D20000-0x0000000000D80000-memory.dmpFilesize
384KB
-
memory/2212-210-0x0000000001490000-0x0000000001491000-memory.dmpFilesize
4KB
-
memory/2212-270-0x0000000001520000-0x0000000001521000-memory.dmpFilesize
4KB
-
memory/2212-299-0x0000000076BF0000-0x00000000771A3000-memory.dmpFilesize
5.7MB
-
memory/2212-222-0x0000000074530000-0x00000000745B9000-memory.dmpFilesize
548KB
-
memory/2212-219-0x0000000000C50000-0x0000000000E81000-memory.dmpFilesize
2.2MB
-
memory/2212-267-0x0000000000C52000-0x0000000000C88000-memory.dmpFilesize
216KB
-
memory/2212-261-0x0000000003050000-0x0000000003096000-memory.dmpFilesize
280KB
-
memory/2212-209-0x0000000000C50000-0x0000000000E81000-memory.dmpFilesize
2.2MB
-
memory/2212-213-0x0000000076920000-0x0000000076B35000-memory.dmpFilesize
2.1MB
-
memory/2212-273-0x00000000717AE000-0x00000000717AF000-memory.dmpFilesize
4KB
-
memory/2424-168-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2424-167-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2424-166-0x0000000002344000-0x000000000234C000-memory.dmpFilesize
32KB
-
memory/2424-150-0x0000000002344000-0x000000000234C000-memory.dmpFilesize
32KB
-
memory/2536-177-0x0000000000400000-0x0000000000D42000-memory.dmpFilesize
9.3MB
-
memory/2536-176-0x00000000027F8000-0x0000000002C35000-memory.dmpFilesize
4.2MB
-
memory/2564-237-0x00000000004F0000-0x00000000008B3000-memory.dmpFilesize
3.8MB
-
memory/2564-239-0x00000000004F0000-0x00000000008B3000-memory.dmpFilesize
3.8MB
-
memory/2656-246-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/2656-243-0x0000000000400000-0x0000000000667000-memory.dmpFilesize
2.4MB
-
memory/3008-233-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3008-238-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3032-249-0x0000000002E00000-0x000000000323D000-memory.dmpFilesize
4.2MB
-
memory/3032-250-0x0000000000400000-0x0000000000D42000-memory.dmpFilesize
9.3MB
-
memory/3180-229-0x0000000074530000-0x00000000745B9000-memory.dmpFilesize
548KB
-
memory/3180-218-0x0000000002F40000-0x0000000002F41000-memory.dmpFilesize
4KB
-
memory/3180-214-0x00000000008E0000-0x00000000009D4000-memory.dmpFilesize
976KB
-
memory/3180-279-0x00000000717AE000-0x00000000717AF000-memory.dmpFilesize
4KB
-
memory/3180-224-0x0000000076920000-0x0000000076B35000-memory.dmpFilesize
2.1MB
-
memory/3180-272-0x00000000008E2000-0x0000000000915000-memory.dmpFilesize
204KB
-
memory/3180-226-0x00000000008E0000-0x00000000009D4000-memory.dmpFilesize
976KB
-
memory/3180-300-0x0000000076BF0000-0x00000000771A3000-memory.dmpFilesize
5.7MB
-
memory/3180-227-0x00000000008E0000-0x00000000009D4000-memory.dmpFilesize
976KB
-
memory/3180-276-0x0000000002FB0000-0x0000000002FB1000-memory.dmpFilesize
4KB
-
memory/3180-271-0x0000000002EE0000-0x0000000002F26000-memory.dmpFilesize
280KB
-
memory/3180-217-0x00000000008E0000-0x00000000009D4000-memory.dmpFilesize
976KB
-
memory/3568-234-0x00000000007A0000-0x00000000007A9000-memory.dmpFilesize
36KB
-
memory/3568-235-0x00000000007B0000-0x00000000007B9000-memory.dmpFilesize
36KB
-
memory/4028-269-0x00000000717AE000-0x00000000717AF000-memory.dmpFilesize
4KB
-
memory/4028-215-0x0000000000310000-0x000000000031C000-memory.dmpFilesize
48KB
-
memory/4324-232-0x00000000057C0000-0x0000000005852000-memory.dmpFilesize
584KB
-
memory/4324-236-0x0000000005740000-0x000000000574A000-memory.dmpFilesize
40KB
-
memory/4324-268-0x00000000717AE000-0x00000000717AF000-memory.dmpFilesize
4KB
-
memory/4324-216-0x0000000000E20000-0x0000000000EEE000-memory.dmpFilesize
824KB
-
memory/4332-171-0x00000000028A6000-0x0000000002CE3000-memory.dmpFilesize
4.2MB
-
memory/4332-172-0x0000000002CF0000-0x0000000003617000-memory.dmpFilesize
9.2MB
-
memory/4332-173-0x0000000000400000-0x0000000000D42000-memory.dmpFilesize
9.3MB
-
memory/4484-240-0x0000000000400000-0x0000000000893000-memory.dmpFilesize
4.6MB
-
memory/4484-241-0x00000000009B1000-0x0000000000A01000-memory.dmpFilesize
320KB
-
memory/4484-242-0x0000000000400000-0x0000000000893000-memory.dmpFilesize
4.6MB
-
memory/4484-256-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/4540-296-0x0000000074530000-0x00000000745B9000-memory.dmpFilesize
548KB
-
memory/4540-260-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/4540-259-0x00000000717AE000-0x00000000717AF000-memory.dmpFilesize
4KB
-
memory/4540-247-0x0000000000BD0000-0x0000000000D63000-memory.dmpFilesize
1.6MB
-
memory/4540-258-0x0000000000BD2000-0x0000000000C07000-memory.dmpFilesize
212KB
-
memory/4540-248-0x0000000000BD2000-0x0000000000C07000-memory.dmpFilesize
212KB
-
memory/4540-257-0x0000000076920000-0x0000000076B35000-memory.dmpFilesize
2.1MB
-
memory/4540-244-0x0000000000B80000-0x0000000000BC6000-memory.dmpFilesize
280KB
-
memory/4540-254-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/4540-302-0x0000000076BF0000-0x00000000771A3000-memory.dmpFilesize
5.7MB