b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 17:23 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
Size

58KB
MD5

3335ed96304ee15d63b63321b40bf090
SHA1

98a3236cede912d51c4d08bc83966a9805d83624
SHA256

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571
SHA512

b22f08d0a072b0387d5b3efc583d075e593f37a3f7201a81897dcebb40284ac2be3550d9890cf0aa664ec9e2b25908be341866e922598dcbde88cdb741ffba8c
SSDEEP

1536:EmbvRTJiHjcd5bT1jTzFpHb0gOnmkELbKntV/uNm:Em1TJiHjKZpHb0gKXEL+uNm

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe:*:enabled:@shell32.dll,-1"	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 588	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	3
PID 212 wrote to memory of 588	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	3
PID 212 wrote to memory of 588	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	3
PID 212 wrote to memory of 588	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	3
PID 212 wrote to memory of 588	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	3
PID 212 wrote to memory of 588	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	3
PID 212 wrote to memory of 664	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	1
PID 212 wrote to memory of 664	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	1
PID 212 wrote to memory of 664	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	1
PID 212 wrote to memory of 664	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	1
PID 212 wrote to memory of 664	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	1
PID 212 wrote to memory of 664	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	1
PID 212 wrote to memory of 772	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	14
PID 212 wrote to memory of 772	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	14
PID 212 wrote to memory of 772	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	14
PID 212 wrote to memory of 772	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	14
PID 212 wrote to memory of 772	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	14
PID 212 wrote to memory of 772	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	14
PID 212 wrote to memory of 776	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	13
PID 212 wrote to memory of 776	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	13
PID 212 wrote to memory of 776	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	13
PID 212 wrote to memory of 776	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	13
PID 212 wrote to memory of 776	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	13
PID 212 wrote to memory of 776	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	13
PID 212 wrote to memory of 788	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	12
PID 212 wrote to memory of 788	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	12
PID 212 wrote to memory of 788	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	12
PID 212 wrote to memory of 788	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	12
PID 212 wrote to memory of 788	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	12
PID 212 wrote to memory of 788	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	12
PID 212 wrote to memory of 900	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	11
PID 212 wrote to memory of 900	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	11
PID 212 wrote to memory of 900	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	11
PID 212 wrote to memory of 900	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	11
PID 212 wrote to memory of 900	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	11
PID 212 wrote to memory of 900	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	11
PID 212 wrote to memory of 952	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	10
PID 212 wrote to memory of 952	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	10
PID 212 wrote to memory of 952	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	10
PID 212 wrote to memory of 952	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	10
PID 212 wrote to memory of 952	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	10
PID 212 wrote to memory of 952	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	10
PID 212 wrote to memory of 328	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	8
PID 212 wrote to memory of 328	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	8
PID 212 wrote to memory of 328	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	8
PID 212 wrote to memory of 328	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	8
PID 212 wrote to memory of 328	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	8
PID 212 wrote to memory of 328	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	8
PID 212 wrote to memory of 444	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	9
PID 212 wrote to memory of 444	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	9
PID 212 wrote to memory of 444	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	9
PID 212 wrote to memory of 444	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	9
PID 212 wrote to memory of 444	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	9
PID 212 wrote to memory of 444	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	9
PID 212 wrote to memory of 408	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	17
PID 212 wrote to memory of 408	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	17
PID 212 wrote to memory of 408	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	17
PID 212 wrote to memory of 408	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	17
PID 212 wrote to memory of 408	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	17
PID 212 wrote to memory of 408	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	17
PID 212 wrote to memory of 860	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	16
PID 212 wrote to memory of 860	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	16
PID 212 wrote to memory of 860	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	16
PID 212 wrote to memory of 860	212	b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe	16

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:328
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:788
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3444
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3384
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3296
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3680
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4352
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:2008
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:1448
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:4412
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4612
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:4360
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3544
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4336

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2256

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2068

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1268
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:652
- C:\Users\Admin\AppData\Local\Temp\b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe
  "C:\Users\Admin\AppData\Local\Temp\b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe"
  2⤵
  - Modifies firewall policy service
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:3472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2480

Network

DNS

ilo.brenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ilo.brenz.pl

IN A

Response

ilo.brenz.pl

IN A

148.81.111.121
DNS

ant.trenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ant.trenz.pl

IN A

Response

ant.trenz.pl

IN A

148.81.111.121
DNS

egainy.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

egainy.com

IN A

Response
DNS

iuinmz.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

iuinmz.com

IN A

Response
DNS

qypdea.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

qypdea.com

IN A

Response
DNS

zsesew.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

zsesew.com

IN A

Response
DNS

nailbz.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

nailbz.com

IN A

Response
DNS

gyrleo.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

gyrleo.com

IN A

Response
DNS

enliuu.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

enliuu.com

IN A

Response
DNS

wuaaxi.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

wuaaxi.com

IN A

Response
DNS

hbmsse.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

hbmsse.com

IN A

Response
DNS

vtluiv.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

vtluiv.com

IN A

Response
DNS

cbaowa.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

cbaowa.com

IN A
DNS

cbaowa.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

cbaowa.com

IN A
DNS

cbaowa.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

cbaowa.com

IN A
DNS

cbaowa.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

cbaowa.com

IN A
DNS

cbaowa.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

cbaowa.com

IN A
DNS

151.122.125.40.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

151.122.125.40.in-addr.arpa

IN PTR

Response
DNS

dogxon.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

dogxon.com

IN A

Response

dogxon.com

IN A

202.254.238.20
DNS

cutudj.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

cutudj.com

IN A

Response
DNS

fhsrxs.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

fhsrxs.com

IN A

Response
DNS

embmot.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

embmot.com

IN A

Response
DNS

zljufi.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

zljufi.com

IN A

Response
DNS

doqukc.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

doqukc.com

IN A

Response
DNS

meigdl.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

meigdl.com

IN A

Response

meigdl.com

IN A

104.21.47.223

meigdl.com

IN A

172.67.173.205
DNS

ilo.brenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ilo.brenz.pl

IN A

Response

ilo.brenz.pl

IN A

148.81.111.121
DNS

ouyhgs.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ouyhgs.com

IN A

Response
DNS

ariqte.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ariqte.com

IN A

Response
DNS

ioqjfg.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ioqjfg.com

IN A

Response
DNS

ttesaw.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ttesaw.com

IN A

Response
DNS

jkwdfs.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

jkwdfs.com

IN A

Response
DNS

lzrktj.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

lzrktj.com

IN A

Response
DNS

keqyus.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

keqyus.com

IN A

Response
DNS

fvhkpu.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

fvhkpu.com

IN A

Response
DNS

argyoh.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

argyoh.com

IN A

Response
DNS

oyczkg.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

oyczkg.com

IN A

Response
DNS

bstoeo.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

bstoeo.com

IN A

Response
DNS

gguaxr.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

gguaxr.com

IN A

Response
DNS

hgzero.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

hgzero.com

IN A

Response

hgzero.com

IN A

154.31.45.113
DNS

ant.trenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ant.trenz.pl

IN A

Response

ant.trenz.pl

IN A

148.81.111.121
DNS

adomhh.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

adomhh.com

IN A

Response
DNS

dmcsdm.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

dmcsdm.com

IN A

Response
DNS

dyktyd.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

dyktyd.com

IN A

Response
DNS

jqrwrc.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

jqrwrc.com

IN A

Response
DNS

jqrpbv.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

jqrpbv.com

IN A

Response
DNS

mircge.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

mircge.com

IN A

Response
DNS

ssmovv.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

ssmovv.com

IN A

Response
DNS

kjirvh.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

kjirvh.com

IN A

Response
DNS

smpaza.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

smpaza.com

IN A

Response
DNS

wwqpst.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

wwqpst.com

IN A

Response
DNS

kbsvwu.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

kbsvwu.com

IN A

Response
DNS

vchaff.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

vchaff.com

IN A

Response
DNS

unsgbd.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

unsgbd.com

IN A

Response
DNS

yoyyst.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

yoyyst.com

IN A

Response
DNS

kbwnai.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

kbwnai.com

IN A

Response
DNS

zeezuu.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

Remote address:

8.8.8.8:53

Request

zeezuu.com

IN A

Response

zeezuu.com

IN A

3.64.163.50

209.197.3.8:80

260 B
5
148.81.111.121:80

ilo.brenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

260 B
200 B
5
5
2.18.109.224:443

RuntimeBroker.exe

322 B
7
20.50.80.209:443

OfficeClickToRun.exe

322 B
7
209.197.3.8:80

CryptSvc

322 B
7
209.197.3.8:80

CryptSvc

322 B
7
209.197.3.8:80

CryptSvc

322 B
7
148.81.111.121:80

ant.trenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

260 B
200 B
5
5
88.198.69.43:80

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

260 B
200 B
5
5
202.254.238.20:443

dogxon.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

190 B
92 B
4
2
104.21.47.223:443

meigdl.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

190 B
132 B
4
3
148.81.111.121:80

ilo.brenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

260 B
200 B
5
5
154.31.45.113:443

hgzero.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

260 B
200 B
5
5
148.81.111.121:80

ant.trenz.pl

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

260 B
200 B
5
5
3.64.163.50:443

zeezuu.com

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

144 B
92 B
3
2

8.8.8.8:53

ilo.brenz.pl

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

58 B
74 B
1
1

DNS Request

ilo.brenz.pl

DNS Response

148.81.111.121
8.8.8.8:53

ant.trenz.pl

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

58 B
74 B
1
1

DNS Request

ant.trenz.pl

DNS Response

148.81.111.121
8.8.8.8:53

egainy.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

egainy.com
8.8.8.8:53

iuinmz.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

iuinmz.com
8.8.8.8:53

qypdea.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

qypdea.com
8.8.8.8:53

zsesew.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

zsesew.com
8.8.8.8:53

nailbz.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

nailbz.com
8.8.8.8:53

gyrleo.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

gyrleo.com
8.8.8.8:53

enliuu.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

enliuu.com
8.8.8.8:53

wuaaxi.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

wuaaxi.com
8.8.8.8:53

hbmsse.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

hbmsse.com
8.8.8.8:53

vtluiv.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

vtluiv.com
8.8.8.8:53

cbaowa.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

280 B
5

DNS Request

cbaowa.com

DNS Request

cbaowa.com

DNS Request

cbaowa.com

DNS Request

cbaowa.com

DNS Request

cbaowa.com
8.8.8.8:53

151.122.125.40.in-addr.arpa

dns

Dnscache

73 B
159 B
1
1

DNS Request

151.122.125.40.in-addr.arpa
8.8.8.8:53

dogxon.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
72 B
1
1

DNS Request

dogxon.com

DNS Response

202.254.238.20
8.8.8.8:53

cutudj.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

cutudj.com
8.8.8.8:53

fhsrxs.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

fhsrxs.com
8.8.8.8:53

embmot.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

embmot.com
8.8.8.8:53

zljufi.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

zljufi.com
8.8.8.8:53

doqukc.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

doqukc.com
8.8.8.8:53

meigdl.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
88 B
1
1

DNS Request

meigdl.com

DNS Response

104.21.47.223

172.67.173.205
8.8.8.8:53

ilo.brenz.pl

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

58 B
74 B
1
1

DNS Request

ilo.brenz.pl

DNS Response

148.81.111.121
8.8.8.8:53

ouyhgs.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

ouyhgs.com
8.8.8.8:53

ariqte.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

ariqte.com
8.8.8.8:53

ioqjfg.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

ioqjfg.com
8.8.8.8:53

ttesaw.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

ttesaw.com
8.8.8.8:53

jkwdfs.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

jkwdfs.com
8.8.8.8:53

lzrktj.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

lzrktj.com
8.8.8.8:53

keqyus.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

keqyus.com
8.8.8.8:53

fvhkpu.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

fvhkpu.com
8.8.8.8:53

argyoh.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

argyoh.com
8.8.8.8:53

oyczkg.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

oyczkg.com
8.8.8.8:53

bstoeo.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

bstoeo.com
8.8.8.8:53

gguaxr.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

gguaxr.com
8.8.8.8:53

hgzero.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
72 B
1
1

DNS Request

hgzero.com

DNS Response

154.31.45.113
8.8.8.8:53

ant.trenz.pl

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

58 B
74 B
1
1

DNS Request

ant.trenz.pl

DNS Response

148.81.111.121
8.8.8.8:53

adomhh.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

adomhh.com
8.8.8.8:53

dmcsdm.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

dmcsdm.com
8.8.8.8:53

dyktyd.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

dyktyd.com
8.8.8.8:53

jqrwrc.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

jqrwrc.com
8.8.8.8:53

jqrpbv.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

jqrpbv.com
8.8.8.8:53

mircge.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

mircge.com
8.8.8.8:53

ssmovv.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

ssmovv.com
8.8.8.8:53

kjirvh.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

kjirvh.com
8.8.8.8:53

smpaza.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

smpaza.com
8.8.8.8:53

wwqpst.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

wwqpst.com
8.8.8.8:53

kbsvwu.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

kbsvwu.com
8.8.8.8:53

vchaff.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

vchaff.com
8.8.8.8:53

unsgbd.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

unsgbd.com
8.8.8.8:53

yoyyst.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

yoyyst.com
8.8.8.8:53

kbwnai.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
129 B
1
1

DNS Request

kbwnai.com
8.8.8.8:53

zeezuu.com

dns

b6bc13f302f70194870dd4d1892c90219ae3a8f24cad9c9c8796dc2a8b84f571.exe

56 B
72 B
1
1

DNS Request

zeezuu.com

DNS Response

3.64.163.50

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/212-132-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download
memory/212-133-0x0000000001000000-0x0000000001013000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.