Resubmissions
19-11-2022 21:40
221119-1jgzlacd49 819-11-2022 13:48
221119-q4ed4adg34 1019-11-2022 06:26
221119-g7aqmscg91 1019-11-2022 05:30
221119-f67hjsbc8t 1015-11-2022 20:50
221115-zm3j2abf6y 1015-11-2022 20:50
221115-zmpm6sfh23 1015-11-2022 20:49
221115-zl6kasfg98 1015-11-2022 20:19
221115-y4ct9sff87 1014-11-2022 19:39
221114-yc4tnsdb92 1014-11-2022 19:34
221114-yakb9adb83 10Analysis
-
max time kernel
2700s -
max time network
2683s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2022 19:39
Static task
static1
Behavioral task
behavioral1
Sample
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe
Resource
win10v2004-20220812-en
General
-
Target
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe
-
Size
307KB
-
MD5
0abe50c1509136bf62d2184ab439e7a5
-
SHA1
722a7e2a0dd66f506ba93d24946b8bf504b100c0
-
SHA256
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50
-
SHA512
0c232d1eaf68c0099fb499fcd40bb33cd604f0259a71b853c296e00cc468342de95548ccf61d9e904cef5d34fd94defbb43f844e9f50a51517c7c95ab66862c5
-
SSDEEP
6144:Gu0FGLnBOUaLPP7S9dW8dsgMF24raEn2E1a:Gu0wTBOU2Pj6EisgM/uUv
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5076-133-0x00000000001F0000-0x00000000001F9000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 64 IoCs
Processes:
rundll32.exeflow pid process 76 2096 rundll32.exe 80 2096 rundll32.exe 86 2096 rundll32.exe 152 2096 rundll32.exe 156 2096 rundll32.exe 157 2096 rundll32.exe 201 2096 rundll32.exe 240 2096 rundll32.exe 242 2096 rundll32.exe 243 2096 rundll32.exe 244 2096 rundll32.exe 245 2096 rundll32.exe 247 2096 rundll32.exe 260 2096 rundll32.exe 261 2096 rundll32.exe 263 2096 rundll32.exe 266 2096 rundll32.exe 269 2096 rundll32.exe 275 2096 rundll32.exe 276 2096 rundll32.exe 284 2096 rundll32.exe 303 2096 rundll32.exe 305 2096 rundll32.exe 306 2096 rundll32.exe 307 2096 rundll32.exe 308 2096 rundll32.exe 309 2096 rundll32.exe 311 2096 rundll32.exe 329 2096 rundll32.exe 330 2096 rundll32.exe 335 2096 rundll32.exe 336 2096 rundll32.exe 337 2096 rundll32.exe 338 2096 rundll32.exe 339 2096 rundll32.exe 341 2096 rundll32.exe 342 2096 rundll32.exe 343 2096 rundll32.exe 344 2096 rundll32.exe 345 2096 rundll32.exe 348 2096 rundll32.exe 349 2096 rundll32.exe 360 2096 rundll32.exe 363 2096 rundll32.exe 364 2096 rundll32.exe 366 2096 rundll32.exe 370 2096 rundll32.exe 371 2096 rundll32.exe 372 2096 rundll32.exe 373 2096 rundll32.exe 375 2096 rundll32.exe 382 2096 rundll32.exe 385 2096 rundll32.exe 387 2096 rundll32.exe 388 2096 rundll32.exe 389 2096 rundll32.exe 391 2096 rundll32.exe 399 2096 rundll32.exe 400 2096 rundll32.exe 401 2096 rundll32.exe 402 2096 rundll32.exe 407 2096 rundll32.exe 408 2096 rundll32.exe 410 2096 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
Processes:
tiaccurD1C7.exeChromeRecovery.exeAbyssFree.exetiaccurtiaccurtiaccurtiaccurpid process 2508 tiaccur 5004 D1C7.exe 1056 ChromeRecovery.exe 4540 AbyssFree.exe 3708 tiaccur 3664 tiaccur 5140 tiaccur 4272 tiaccur -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AXSLE\Parameters\ServiceDll = "C:\\Program Files (x86)\\Windows Multimedia Platform\\AXSLE.dll" rundll32.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AXSLE\ImagePath = "C:\\Windows\\system32\\svchost.exe -k LocalService" rundll32.exe -
Processes:
resource yara_rule behavioral1/memory/4540-214-0x00000000008D0000-0x0000000000DCD000-memory.dmp vmprotect behavioral1/memory/4540-215-0x00000000008D0000-0x0000000000DCD000-memory.dmp vmprotect -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exesvchost.exerundll32.exepid process 2096 rundll32.exe 4560 svchost.exe 4560 svchost.exe 4036 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts rundll32.exe -
Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rundll32.exedescription ioc process File opened (read-only) \??\I: rundll32.exe File opened (read-only) \??\L: rundll32.exe File opened (read-only) \??\Q: rundll32.exe File opened (read-only) \??\R: rundll32.exe File opened (read-only) \??\T: rundll32.exe File opened (read-only) \??\V: rundll32.exe File opened (read-only) \??\B: rundll32.exe File opened (read-only) \??\E: rundll32.exe File opened (read-only) \??\G: rundll32.exe File opened (read-only) \??\N: rundll32.exe File opened (read-only) \??\S: rundll32.exe File opened (read-only) \??\A: rundll32.exe File opened (read-only) \??\F: rundll32.exe File opened (read-only) \??\O: rundll32.exe File opened (read-only) \??\Y: rundll32.exe File opened (read-only) \??\U: rundll32.exe File opened (read-only) \??\W: rundll32.exe File opened (read-only) \??\X: rundll32.exe File opened (read-only) \??\H: rundll32.exe File opened (read-only) \??\J: rundll32.exe File opened (read-only) \??\K: rundll32.exe File opened (read-only) \??\M: rundll32.exe File opened (read-only) \??\P: rundll32.exe File opened (read-only) \??\Z: rundll32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
rundll32.exedescription pid process target process PID 2096 set thread context of 4724 2096 rundll32.exe rundll32.exe PID 2096 set thread context of 4904 2096 rundll32.exe rundll32.exe -
Drops file in Program Files directory 37 IoCs
Processes:
rundll32.exeelevation_service.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud.png rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt rundll32.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt rundll32.exe File created C:\Program Files (x86)\Windows Multimedia Platform\AcroSup64.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-heap-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\application.ini rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\webcompat-reporter@mozilla.org.xpi rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt rundll32.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\ChromeRecoveryCRX.crx elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\acrobat_pdf.svg rundll32.exe File created C:\Program Files (x86)\Windows Multimedia Platform\stopwords.ENU rundll32.exe File created C:\Program Files (x86)\Windows Multimedia Platform\AXSLE.dll rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-timezone-l1-1-0.dll rundll32.exe File created C:\Program Files (x86)\Windows Multimedia Platform\sendforcomments.svg rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll rundll32.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\ChromeRecovery.exe elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\manifest.json elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforcomments.svg rundll32.exe File created C:\Program Files (x86)\Windows Multimedia Platform\acrobat_pdf.svg rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-file-l1-2-0.dll rundll32.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-crt-process-l1-1-0.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\stopwords.ENU rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt rundll32.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroSup64.dll rundll32.exe File created C:\Program Files (x86)\Windows Multimedia Platform\ccloud.png rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3184 5004 WerFault.exe D1C7.exe -
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
tiaccurtiaccurtiaccurtiaccurdb79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exetiaccurdescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tiaccur -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exerundll32.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Processes:
description ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser -
Modifies registry class 64 IoCs
Processes:
rundll32.exechrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000070000001800000030f125b7ef471a10a5f102608c9eebac0a000000f000000030f125b7ef471a10a5f102608c9eebac04000000a0000000e0cc8de8b3b7d111a9f000aa0060fa310600000080000000e0cc8de8b3b7d111a9f000aa0060fa31020000005000000030f125b7ef471a10a5f102608c9eebac0c00000080000000e0cc8de8b3b7d111a9f000aa0060fa31040000005000000030f125b7ef471a10a5f102608c9eebac0e000000a0000000 Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Rev = "0" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9} Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 7800d020ea3a6910000000000000000000000000000000000000000000000000100000004e002f004100000000000000f022be0c00000000010000000000000080e4f209000000000100000000000000ffff00000a00000000000000410062007900730073002d00460072006500650000000000000000000000 Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags = "18874385" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\IconSize = "16" Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupView = "0" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 6a003200ca1a2c006e5504a6200041425953532d7e312e5a495000004e0009000400efbe6e5504a66e5504a62e000000000000000000000000000000000000000000000000007353b200410062007900730073002d0046007200650065002e007a006900700000001c000000 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Mode = "4" Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode = "1" Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID = "0" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = ffffffff Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID = "0" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\NodeSlot = "2" Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags = "18874369" Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9} Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Mode = "4" Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" -
Processes:
rundll32.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D6C8825DF2FED19C76950950273B4B8C049FFEED\Blob = 030000000100000014000000d6c8825df2fed19c76950950273b4b8c049ffeed2000000001000000d4020000308202d030820239a0030201020208173597f534156378300d06092a864886f70d01010b0500307f313e303c06035504030c354d6963726f736f6674204543432050726f6475637420526f687420436572746966696361746520417574686f726974792032303138311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e64301e170d3230313131343230343335325a170d3234313131333230343335325a307f313e303c06035504030c354d6963726f736f6674204543432050726f6475637420526f687420436572746966696361746520417574686f726974792032303138311e301c060355040a0c154d6963726f736f667420436f72706f726174696f6e310b30090603550406130255533110300e06035504070c075265646d6f6e6430819f300d06092a864886f70d010101050003818d0030818902818100a3238ca45386415396c9f72bf8bc34bd1c2548b1244d6dfa9b4052f820478d19c7202ceb782235daf5a0cd29e9cb254b97a048cd07f099072f5e00116388ec8e42d68a1a26997cff31f59394830d71804b797f8783bbfd365e82958a5572a575b9ba8b088107634bb75799a62e8eec18f33f49ac29d8faa9eaf4e6a0624423030203010001a3553053300f0603551d130101ff040530030101ff30400603551d110439303782354d6963726f736f6674204543432050726f6475637420526f687420436572746966696361746520417574686f726974792032303138300d06092a864886f70d01010b0500038181009f625bee6aafbf01d54ad764915e7c65d7b1bfe27ffe96f360c89caaef224df58ecba19586b74ed9cf6ac873c33b186693087f037c5ed40a80dc7ffa00f4d742940d5240ce77eba071fbed62f0562970addf949f26d0c9aeeab250ec555c3f73f718cfc5fa7c8c9131e1af2ec092b46312fcda4ed1dd8e939082521e2eda5c81 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D6C8825DF2FED19C76950950273B4B8C049FFEED rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2436 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
pid process 1084 1084 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exepid process 5076 db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe 5076 db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1084 -
Suspicious behavior: LoadsDriver 8 IoCs
Processes:
pid process 648 648 648 648 648 648 648 648 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exetiaccurtiaccurtiaccurtiaccurtiaccurpid process 5076 db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe 2508 tiaccur 3708 tiaccur 3664 tiaccur 5140 tiaccur 4272 tiaccur -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
Processes:
chrome.exepid process 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
rundll32.exedescription pid process Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeDebugPrivilege 2096 rundll32.exe Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 Token: SeCreatePagefilePrivilege 1084 Token: SeShutdownPrivilege 1084 -
Suspicious use of FindShellTrayWindow 54 IoCs
Processes:
rundll32.exerundll32.exechrome.exerundll32.exepid process 4724 rundll32.exe 1084 1084 1084 1084 1084 1084 1084 1084 2096 rundll32.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1084 4904 rundll32.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1084 1084 1084 1084 1084 1084 1084 -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exepid process 1084 1084 1084 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 1084 -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
pid process 1084 1084 1084 1084 1084 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
D1C7.exerundll32.exesvchost.exechrome.exedescription pid process target process PID 1084 wrote to memory of 5004 1084 D1C7.exe PID 1084 wrote to memory of 5004 1084 D1C7.exe PID 1084 wrote to memory of 5004 1084 D1C7.exe PID 5004 wrote to memory of 2096 5004 D1C7.exe rundll32.exe PID 5004 wrote to memory of 2096 5004 D1C7.exe rundll32.exe PID 5004 wrote to memory of 2096 5004 D1C7.exe rundll32.exe PID 2096 wrote to memory of 4724 2096 rundll32.exe rundll32.exe PID 2096 wrote to memory of 4724 2096 rundll32.exe rundll32.exe PID 2096 wrote to memory of 4724 2096 rundll32.exe rundll32.exe PID 4560 wrote to memory of 4036 4560 svchost.exe rundll32.exe PID 4560 wrote to memory of 4036 4560 svchost.exe rundll32.exe PID 4560 wrote to memory of 4036 4560 svchost.exe rundll32.exe PID 2096 wrote to memory of 1044 2096 rundll32.exe schtasks.exe PID 2096 wrote to memory of 1044 2096 rundll32.exe schtasks.exe PID 2096 wrote to memory of 1044 2096 rundll32.exe schtasks.exe PID 2096 wrote to memory of 504 2096 rundll32.exe schtasks.exe PID 2096 wrote to memory of 504 2096 rundll32.exe schtasks.exe PID 2096 wrote to memory of 504 2096 rundll32.exe schtasks.exe PID 1084 wrote to memory of 1948 1084 chrome.exe PID 1084 wrote to memory of 1948 1084 chrome.exe PID 1948 wrote to memory of 1988 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 1988 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 4108 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 2140 1948 chrome.exe chrome.exe PID 1948 wrote to memory of 2140 1948 chrome.exe chrome.exe -
outlook_office_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe -
outlook_win_path 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe"C:\Users\Admin\AppData\Local\Temp\db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\tiaccurC:\Users\Admin\AppData\Roaming\tiaccur1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D1C7.exeC:\Users\Admin\AppData\Local\Temp\D1C7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Hefurhy.dll,start2⤵
- Blocklisted process makes network request
- Sets DLL path for service in the registry
- Sets service image path in registry
- Loads dropped DLL
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 163343⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\schtasks.exeschtasks /End /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 163343⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 5362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5004 -ip 50041⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windows multimedia platform\axsle.dll",YlwGTTc=2⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffed0ae4f50,0x7ffed0ae4f60,0x7ffed0ae4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4632 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4528 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4576 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4732 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2924 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1104 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4892 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5532 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4532 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5440 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3228 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5256 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2336 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4816 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6092 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6004 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6016 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5988 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3388 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=344 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1600,6775071889734886256,17618244439316926216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:82⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={61cd4f2d-3018-45be-a651-535b2c19b26f} --system2⤵
- Executes dropped EXE
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x464 0x4941⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Instructions.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\AbyssFree.exe"C:\Users\Admin\Desktop\AbyssFree.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\tiaccurC:\Users\Admin\AppData\Roaming\tiaccur1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\tiaccurC:\Users\Admin\AppData\Roaming\tiaccur1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\tiaccurC:\Users\Admin\AppData\Roaming\tiaccur1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\tiaccurC:\Users\Admin\AppData\Roaming\tiaccur1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Windows Multimedia Platform\AXSLE.dllFilesize
4.3MB
MD5c916c996cb48c3cefc8fb6366cf1ffe5
SHA1af6bf85b9ed53c780f6d26b1c704cf979db73be9
SHA256f8e6296b4856f771ea5c6ae0ff4a28f765d57830c6665743830a34e8c39cd5b8
SHA5122eacdfaffe0957deebcc0dc7229b6991e905b0d65508ba5dfcfb2e5bd0d5bdd33d2a6fec87cec9aca33f6750cf179ddbb5de5e1e0ca986ed23ac738e7485985a
-
C:\Program Files (x86)\Windows Multimedia Platform\AXSLE.dllFilesize
4.3MB
MD5c916c996cb48c3cefc8fb6366cf1ffe5
SHA1af6bf85b9ed53c780f6d26b1c704cf979db73be9
SHA256f8e6296b4856f771ea5c6ae0ff4a28f765d57830c6665743830a34e8c39cd5b8
SHA5122eacdfaffe0957deebcc0dc7229b6991e905b0d65508ba5dfcfb2e5bd0d5bdd33d2a6fec87cec9aca33f6750cf179ddbb5de5e1e0ca986ed23ac738e7485985a
-
C:\Program Files (x86)\Windows Multimedia Platform\AXSLE.dllFilesize
4.3MB
MD5c916c996cb48c3cefc8fb6366cf1ffe5
SHA1af6bf85b9ed53c780f6d26b1c704cf979db73be9
SHA256f8e6296b4856f771ea5c6ae0ff4a28f765d57830c6665743830a34e8c39cd5b8
SHA5122eacdfaffe0957deebcc0dc7229b6991e905b0d65508ba5dfcfb2e5bd0d5bdd33d2a6fec87cec9aca33f6750cf179ddbb5de5e1e0ca986ed23ac738e7485985a
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir828_1384687905\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\ProgramData\{392362DC-8934-5464-5D27-4C0C2FAEDB8D}\1527c705-839a-4832-9118-54d4Bd6a0c89_10.0.19041.1023_neutral_neutral_cw5n1h2txyewy.xmlFilesize
2KB
MD5d2d725a3c34b3597b164a038ec06085a
SHA152eb2334afeccafd46b205de0d2c7306cb7b7c8d
SHA25601bc9a89105cebd77ff81b814f794a71cbccf40f4d3e663758e63e202f5e1f00
SHA5126f23fc81a4a5308966892ef880048ff079aec5968af5d6fcc0315c05533d597865b0572d18e0368da4ff85c9136b87a4cb9e878bc28738a18025d576b5a3f306
-
C:\ProgramData\{392362DC-8934-5464-5D27-4C0C2FAEDB8D}\C2RManifest.Word.Word.x-none.msi.16.x-none.xmlFilesize
93KB
MD52e8a1f4e2c4678c174e9f328fc9c0846
SHA139a7038d855f22e339bd26e578d02804ed7ec3b4
SHA256846687ca03420046249f3525dc02ee08099671d8a3f48f42046febff9eedc877
SHA51221cc574180abb4068293e44eb42820f57d4fc238a7677443997afa289a15c85f6c51311875a2c10edfe974dc56f484da0fe5dfeb2c0a4ca34ab977e1b0c2dd75
-
C:\ProgramData\{392362DC-8934-5464-5D27-4C0C2FAEDB8D}\Ehwfrpyeiieqydh.tmpFilesize
3.5MB
MD568c5b0ce87ed8faef98b6d86084afb6f
SHA11376e85153b6e1aeea25cc25587db37f993b261b
SHA256e86875212b740791a41e84624697841b38d486363ceffc3f56baf7ec8c3ded5a
SHA51294735cfed7f8bce22239c060b215e7e20622e37a835284b94d520188a27798e52d668d1ff83cb9e77b7619dc1e303a5612682d3f8ac8e36796151c99c447ae7d
-
C:\ProgramData\{392362DC-8934-5464-5D27-4C0C2FAEDB8D}\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe.xmlFilesize
15KB
MD52f71d0396b93381c1fd86bf822612868
SHA1d0801700dd00a51276f32c6ed19f5b713b5db825
SHA2560543ea8c8efce3d69431f57affc2cfa44df1b9244a25ed080e4b2014d0419026
SHA51267022ce5c41641799abff9e68cb3f049c5d932aea5c6fd8748469e2e7f51f987f1bdfc7d831a8d11a69d99a77cc363c51db8be6ad50e4014eb63a15c1f25a722
-
C:\ProgramData\{392362DC-8934-5464-5D27-4C0C2FAEDB8D}\Pending.GRLFilesize
14KB
MD5fffde3df0d91311b7fe3f9bc8642a9ec
SHA150987906817aab51e2cc29fbce47ac5f0936a44e
SHA256bda9df3591bf7f67d4b31d23cffdcf927da6f00ae1b393f07aea69ba1c4344bc
SHA5125e0766c25f54b03ca0325966ba059cbfb9cdb0aeae567106583fdff944d67522516acabb9b261e2fd434c1a5af5c5453a09c9dc494008253b0553a993c01d3d3
-
C:\ProgramData\{392362DC-8934-5464-5D27-4C0C2FAEDB8D}\VdiState.xmlFilesize
892B
MD505a593ddf82be0bb1f258c9d0585f75d
SHA16712a2dd452fc768e5d9f7cd3805d1592c27d676
SHA256bf438bec47694988412b0b5d395e112ffd4376521c0cc9c523a2a8d265c3b6be
SHA512f379ebcc30a0368757500677691d5429fc4a1876379fb83101f7183e844bed37577fcf836cbbcdd09ff696e24745fdc9aa3149c4d7ea1fdc7d9fe243d384ece4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.dbFilesize
28KB
MD5281cfa1cc10078007633dd7a031bfb5e
SHA1a98def152692ddcc9df7b39d32b7756b8b36bbf0
SHA256b9e23b9b45249dad6a7b0cd1f9a1649a246d2ee9d1696d97eb3cdf7241b96cd6
SHA512417eb797af8b64d1071edcbed9ec8a01117f2467548f4d1b0af432f5f8167b0e87d579955324884a696cd87287ec604cb2b260e4f2c9496c4a239919e54b87ce
-
C:\Users\Admin\AppData\Local\Temp\D1C7.exeFilesize
3.0MB
MD5a6809a0da3ac7da364c708f781161cf6
SHA1e68f010ad14d7f00890c755a3ec5135027b355e4
SHA256c40e7bef8854ab8d7f96917ca4650bc04915c68837b5459565c3bec26db45b84
SHA5127eeb9fb194121b61259efe1f14b8471b06e8a1817ce7ca8ddb2101d6bbfcb327ecd384207c987e1e130a61a32be54198013e8a490bf61afd6d53d9f0b3e26dce
-
C:\Users\Admin\AppData\Local\Temp\D1C7.exeFilesize
3.0MB
MD5a6809a0da3ac7da364c708f781161cf6
SHA1e68f010ad14d7f00890c755a3ec5135027b355e4
SHA256c40e7bef8854ab8d7f96917ca4650bc04915c68837b5459565c3bec26db45b84
SHA5127eeb9fb194121b61259efe1f14b8471b06e8a1817ce7ca8ddb2101d6bbfcb327ecd384207c987e1e130a61a32be54198013e8a490bf61afd6d53d9f0b3e26dce
-
C:\Users\Admin\AppData\Local\Temp\Hefurhy.dllFilesize
4.3MB
MD536d9f6010026093afe21d0adac159d7e
SHA17ee5c5a00f7eec56584db3e589483e53308e4594
SHA2562ed0c4f1d7fc343a6fa2845f2501e74ba451e90023d1b308d6f4647495857d0b
SHA5120d61165954ff97d4aec780922843aa45090fcce0f6960411afe92e92cd12beaaba69fe79c5cca77b86f64340a36225fc6f30683dba6b5da50b7c8c3cc7c8f383
-
C:\Users\Admin\AppData\Local\Temp\Hefurhy.dllFilesize
4.3MB
MD536d9f6010026093afe21d0adac159d7e
SHA17ee5c5a00f7eec56584db3e589483e53308e4594
SHA2562ed0c4f1d7fc343a6fa2845f2501e74ba451e90023d1b308d6f4647495857d0b
SHA5120d61165954ff97d4aec780922843aa45090fcce0f6960411afe92e92cd12beaaba69fe79c5cca77b86f64340a36225fc6f30683dba6b5da50b7c8c3cc7c8f383
-
C:\Users\Admin\AppData\Roaming\tiaccurFilesize
307KB
MD50abe50c1509136bf62d2184ab439e7a5
SHA1722a7e2a0dd66f506ba93d24946b8bf504b100c0
SHA256db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50
SHA5120c232d1eaf68c0099fb499fcd40bb33cd604f0259a71b853c296e00cc468342de95548ccf61d9e904cef5d34fd94defbb43f844e9f50a51517c7c95ab66862c5
-
C:\Users\Admin\AppData\Roaming\tiaccurFilesize
307KB
MD50abe50c1509136bf62d2184ab439e7a5
SHA1722a7e2a0dd66f506ba93d24946b8bf504b100c0
SHA256db79d6a667294c81210d9aa4d989f35832e75151863c2d216787028ae673da50
SHA5120c232d1eaf68c0099fb499fcd40bb33cd604f0259a71b853c296e00cc468342de95548ccf61d9e904cef5d34fd94defbb43f844e9f50a51517c7c95ab66862c5
-
C:\Users\Admin\Desktop\Instructions.txtFilesize
886B
MD58e31639b8d495ab3456dd55823f3b743
SHA1e4436332efb25034a21d0b46d6b431de1b5f88f6
SHA256ab1fa996ecce1b6682928d4baf6512bccede1317e65a291c96892083ddf74a0c
SHA512d7db133046b458d5a366df4d4a636cb5f7194c745e49842b107ce0a61ecfd166ea955f5482bf8c9f997589badca8f5ac0a7ad5925b87e10ab955984cab1650fb
-
C:\Users\Admin\Downloads\Abyss-Free.zipFilesize
2.8MB
MD5857482d2aedd2ac2b1084856c848fab3
SHA1198fbde0822b79fc4aa824233e8be27c6728ee88
SHA2561f6a5a38e4446ec21b23b0f725bafde04e1be913016c92f9d00e3b33f67f17e9
SHA512f1b383f03f5d15a6b34a697fd0872bc520d236b0736ef9969105ea7b5bb70b4c6a604eb263fc38ce83a4bd8899f126e94ae8a3a20c0e85b46d48d2c8d0244bfa
-
\??\c:\program files (x86)\windows multimedia platform\axsle.dllFilesize
4.3MB
MD5c916c996cb48c3cefc8fb6366cf1ffe5
SHA1af6bf85b9ed53c780f6d26b1c704cf979db73be9
SHA256f8e6296b4856f771ea5c6ae0ff4a28f765d57830c6665743830a34e8c39cd5b8
SHA5122eacdfaffe0957deebcc0dc7229b6991e905b0d65508ba5dfcfb2e5bd0d5bdd33d2a6fec87cec9aca33f6750cf179ddbb5de5e1e0ca986ed23ac738e7485985a
-
\??\pipe\crashpad_1948_JBDZPSBGFKLVEICWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/504-195-0x0000000000000000-mapping.dmp
-
memory/1044-194-0x0000000000000000-mapping.dmp
-
memory/1056-207-0x0000000000000000-mapping.dmp
-
memory/2096-154-0x0000000003820000-0x00000000043AC000-memory.dmpFilesize
11.5MB
-
memory/2096-155-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-160-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-147-0x0000000000000000-mapping.dmp
-
memory/2096-159-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-200-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-150-0x0000000000400000-0x0000000000851000-memory.dmpFilesize
4.3MB
-
memory/2096-164-0x00000000044E9000-0x00000000044EB000-memory.dmpFilesize
8KB
-
memory/2096-158-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-152-0x0000000000400000-0x0000000000851000-memory.dmpFilesize
4.3MB
-
memory/2096-167-0x0000000003820000-0x00000000043AC000-memory.dmpFilesize
11.5MB
-
memory/2096-157-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-156-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-199-0x0000000004470000-0x00000000045B0000-memory.dmpFilesize
1.2MB
-
memory/2096-153-0x0000000003820000-0x00000000043AC000-memory.dmpFilesize
11.5MB
-
memory/2436-211-0x0000000000000000-mapping.dmp
-
memory/2508-140-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/2508-138-0x0000000000A73000-0x0000000000A89000-memory.dmpFilesize
88KB
-
memory/2508-139-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/3664-221-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/3664-220-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/3664-219-0x00000000008E4000-0x00000000008F9000-memory.dmpFilesize
84KB
-
memory/3708-218-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/3708-216-0x0000000000A04000-0x0000000000A19000-memory.dmpFilesize
84KB
-
memory/3708-217-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/4036-185-0x0000000002EC0000-0x0000000003A4C000-memory.dmpFilesize
11.5MB
-
memory/4036-184-0x0000000000400000-0x0000000000851000-memory.dmpFilesize
4.3MB
-
memory/4036-182-0x0000000000000000-mapping.dmp
-
memory/4036-187-0x0000000002EC0000-0x0000000003A4C000-memory.dmpFilesize
11.5MB
-
memory/4036-192-0x0000000000400000-0x0000000000851000-memory.dmpFilesize
4.3MB
-
memory/4036-193-0x0000000002EC0000-0x0000000003A4C000-memory.dmpFilesize
11.5MB
-
memory/4272-225-0x0000000000B14000-0x0000000000B29000-memory.dmpFilesize
84KB
-
memory/4272-226-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/4272-227-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/4540-213-0x0000000000000000-mapping.dmp
-
memory/4540-214-0x00000000008D0000-0x0000000000DCD000-memory.dmpFilesize
5.0MB
-
memory/4540-215-0x00000000008D0000-0x0000000000DCD000-memory.dmpFilesize
5.0MB
-
memory/4560-171-0x0000000001B00000-0x0000000001F51000-memory.dmpFilesize
4.3MB
-
memory/4560-196-0x0000000001B00000-0x0000000001F51000-memory.dmpFilesize
4.3MB
-
memory/4560-197-0x0000000002640000-0x00000000031CC000-memory.dmpFilesize
11.5MB
-
memory/4560-172-0x0000000001B00000-0x0000000001F51000-memory.dmpFilesize
4.3MB
-
memory/4560-179-0x0000000002640000-0x00000000031CC000-memory.dmpFilesize
11.5MB
-
memory/4560-180-0x0000000002640000-0x00000000031CC000-memory.dmpFilesize
11.5MB
-
memory/4560-181-0x0000000002640000-0x00000000031CC000-memory.dmpFilesize
11.5MB
-
memory/4724-165-0x0000000000120000-0x00000000003B2000-memory.dmpFilesize
2.6MB
-
memory/4724-166-0x000001D1F7490000-0x000001D1F7733000-memory.dmpFilesize
2.6MB
-
memory/4724-163-0x000001D1F8EE0000-0x000001D1F9020000-memory.dmpFilesize
1.2MB
-
memory/4724-162-0x000001D1F8EE0000-0x000001D1F9020000-memory.dmpFilesize
1.2MB
-
memory/4724-161-0x00007FF6F7AA6890-mapping.dmp
-
memory/4904-205-0x0000025465020000-0x00000254652C3000-memory.dmpFilesize
2.6MB
-
memory/4904-204-0x0000025465020000-0x00000254652C3000-memory.dmpFilesize
2.6MB
-
memory/4904-203-0x0000025466A70000-0x0000025466BB0000-memory.dmpFilesize
1.2MB
-
memory/4904-202-0x0000025466A70000-0x0000025466BB0000-memory.dmpFilesize
1.2MB
-
memory/4904-201-0x00007FF6F7AA6890-mapping.dmp
-
memory/5004-145-0x0000000002B10000-0x0000000002E11000-memory.dmpFilesize
3.0MB
-
memory/5004-141-0x0000000000000000-mapping.dmp
-
memory/5004-144-0x0000000000FAB000-0x000000000126E000-memory.dmpFilesize
2.8MB
-
memory/5004-146-0x0000000000400000-0x0000000000AFC000-memory.dmpFilesize
7.0MB
-
memory/5004-151-0x0000000000400000-0x0000000000AFC000-memory.dmpFilesize
7.0MB
-
memory/5076-133-0x00000000001F0000-0x00000000001F9000-memory.dmpFilesize
36KB
-
memory/5076-134-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/5076-135-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/5076-132-0x0000000000A92000-0x0000000000AA7000-memory.dmpFilesize
84KB
-
memory/5140-222-0x00000000009E4000-0x00000000009F9000-memory.dmpFilesize
84KB
-
memory/5140-223-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB
-
memory/5140-224-0x0000000000400000-0x0000000000850000-memory.dmpFilesize
4.3MB