Analysis
-
max time kernel
151s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 23:10
Static task
static1
Behavioral task
behavioral1
Sample
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe
Resource
win7-20220812-en
General
-
Target
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe
-
Size
756KB
-
MD5
3fcd710621e35d3b44cfdf5526713409
-
SHA1
9ae6828fe48e807f657d0bcec12bdc08bf127f91
-
SHA256
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2
-
SHA512
746be9048423dbd744516ee5b1a119b97e011397e580f673a12659eb17d10b6aff38124aa6529871de4e917f1ece7f088c225bce4d753722cc61de27fbd4de6d
-
SSDEEP
12288:ptDKf5rbJVpa/ZPJ0qY55dvq2W2C2yoCyBCZM6OdXA3N544+DeuAKksdj2LpGZ8K:pgpayvj4HvjZCWK4+De4lZPFHG0KadHN
Malware Config
Extracted
cybergate
2.6
Victime
ownyou78.no-ip.org:1605
***MUTEX***
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
texto da mensagem
-
message_box_title
tÃtulo da mensagem
-
password
1234
Signatures
-
Adds policy Run key to start application 2 TTPs 8 IoCs
Processes:
vbc.exevbc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\dir\\install\\install\\server.exe" vbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe" vbc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe" vbc.exe -
Executes dropped EXE 13 IoCs
Processes:
UjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeserver.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exepid process 1340 UjKeLIOIcLXr.exe 1500 UjKeLIOIcLXr.exe 2044 UjKeLIOIcLXr.exe 1624 UjKeLIOIcLXr.exe 2060 server.exe 2624 UjKeLIOIcLXr.exe 2676 UjKeLIOIcLXr.exe 2792 UjKeLIOIcLXr.exe 2832 UjKeLIOIcLXr.exe 2892 UjKeLIOIcLXr.exe 2932 UjKeLIOIcLXr.exe 2980 UjKeLIOIcLXr.exe 3020 UjKeLIOIcLXr.exe -
Modifies Installed Components in the registry 2 TTPs 6 IoCs
Processes:
vbc.exeexplorer.exevbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50U322NA-MH13-G4K1-J78N-4YE08B206J74}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe Restart" vbc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{50U322NA-MH13-G4K1-J78N-4YE08B206J74} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50U322NA-MH13-G4K1-J78N-4YE08B206J74}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\install\\server.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{50U322NA-MH13-G4K1-J78N-4YE08B206J74} vbc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{50U322NA-MH13-G4K1-J78N-4YE08B206J74}\StubPath = "c:\\dir\\install\\install\\server.exe Restart" vbc.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{50U322NA-MH13-G4K1-J78N-4YE08B206J74} vbc.exe -
Processes:
resource yara_rule behavioral1/memory/1148-97-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1148-107-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1772-112-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1772-114-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/748-118-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1088-132-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/748-127-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1148-134-0x00000000240F0000-0x0000000024152000-memory.dmp upx behavioral1/memory/1088-141-0x0000000024010000-0x0000000024072000-memory.dmp upx behavioral1/memory/1148-142-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1268-147-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/748-158-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/2280-165-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1268-168-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/2280-167-0x0000000024160000-0x00000000241C2000-memory.dmp upx behavioral1/memory/1772-171-0x0000000024080000-0x00000000240E2000-memory.dmp upx behavioral1/memory/1088-172-0x0000000024010000-0x0000000024072000-memory.dmp upx -
Loads dropped DLL 17 IoCs
Processes:
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exeb19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exeexplorer.exepid process 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1088 explorer.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
UjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exeUjKeLIOIcLXr.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\Users\\Admin\\AppData\\Roaming\\IMG788_548745.exe" UjKeLIOIcLXr.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exeb19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exedescription pid process target process PID 1940 set thread context of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 set thread context of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe -
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2248 1268 WerFault.exe vbc.exe 2508 2280 WerFault.exe vbc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exeb19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exepid process 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1088 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exeb19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe Token: SeDebugPrivilege 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe Token: SeDebugPrivilege 1088 explorer.exe Token: SeDebugPrivilege 1088 explorer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
vbc.exevbc.exeDllHost.exepid process 1148 vbc.exe 748 vbc.exe 1864 DllHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exeb19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exevbc.exedescription pid process target process PID 1992 wrote to memory of 1940 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe PID 1992 wrote to memory of 1940 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe PID 1992 wrote to memory of 1940 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe PID 1992 wrote to memory of 1940 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1148 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1940 wrote to memory of 1500 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1940 wrote to memory of 1500 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1940 wrote to memory of 1500 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1940 wrote to memory of 1500 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1940 wrote to memory of 1340 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1940 wrote to memory of 1340 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1940 wrote to memory of 1340 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1940 wrote to memory of 1340 1940 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 748 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe vbc.exe PID 1992 wrote to memory of 1624 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 1624 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 1624 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 1624 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 2044 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 2044 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 2044 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1992 wrote to memory of 2044 1992 b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe UjKeLIOIcLXr.exe PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE PID 1148 wrote to memory of 1192 1148 vbc.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe"C:\Users\Admin\AppData\Local\Temp\b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe"C:\Users\Admin\AppData\Local\Temp\b19d472c52c3060d1e41e7b203c725be2571acb91d30bf53269d241d1487f0c2.exe"3⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe4⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Modifies Installed Components in the registry
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 5086⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe4⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\install\server.exe"C:\Users\Admin\AppData\Roaming\install\server.exe"5⤵
- Executes dropped EXE
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 5085⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD50de49df5cbe5454d53fe0224b1c0df11
SHA1142946dab4f1a475018c7fe9d3b893a7e5d91df5
SHA2560853955abfb984190fddb0b6ab6807b7a8be310fd387331ee3b014c96123769c
SHA512930f515018868617cd86500d90aa878f04cd59d0acf79dbfc3be95ecd669be965218461c3aee6b25860c8ac293a1a10054f2270d5d495acea199f4f55ce00eb1
-
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txtFilesize
229KB
MD50de49df5cbe5454d53fe0224b1c0df11
SHA1142946dab4f1a475018c7fe9d3b893a7e5d91df5
SHA2560853955abfb984190fddb0b6ab6807b7a8be310fd387331ee3b014c96123769c
SHA512930f515018868617cd86500d90aa878f04cd59d0acf79dbfc3be95ecd669be965218461c3aee6b25860c8ac293a1a10054f2270d5d495acea199f4f55ce00eb1
-
C:\Users\Admin\AppData\Roaming\11.jpgFilesize
14KB
MD5cda3a03b12eeffb35751d7b310d0a2b0
SHA15ebd4aeafab46b01f3e8567fca1528f75b8f0bb8
SHA256c26f6b2ae0c47c247d8753587ea9905c91db353e1f59280de7a55f0984b2309b
SHA512c3c71ee72393d2123f9daa3ad7ce6cdaa03627ef733c5a950b644bddd8ad6cd86741a43f7296d08875e7270249f79be285d7d65a18f212583a24972821e51967
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
C:\Users\Admin\AppData\Roaming\install\server.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
C:\Users\Admin\AppData\Roaming\install\server.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\??\c:\dir\install\install\server.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\UjKeLIOIcLXr.exeFilesize
4KB
MD581b6841fca7fea086a8fbfd80c2291f0
SHA138e402c930ded07e524de07e3667eb5209cbfce8
SHA25687f3f7dad59792435ef54bf704a1915fd05d7e02c544c852a53b2e800d5976d4
SHA512818fdd6e246f166b4eb0c36a093dd1b29102139179f161c2afdf4294987b0ee984e643435b3a3cbea8c498930a294fde2779583eb7fb5c3c11ac8ca799b537b6
-
\Users\Admin\AppData\Roaming\install\server.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/748-127-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/748-158-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/748-80-0x000000000040BBF4-mapping.dmp
-
memory/748-113-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/748-163-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/748-118-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1088-122-0x0000000000000000-mapping.dmp
-
memory/1088-141-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1088-172-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1088-132-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1148-142-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1148-58-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1148-75-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1148-60-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1148-134-0x00000000240F0000-0x0000000024152000-memory.dmpFilesize
392KB
-
memory/1148-97-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1148-148-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1148-107-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1148-59-0x000000000040BBF4-mapping.dmp
-
memory/1148-79-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1192-101-0x0000000024010000-0x0000000024072000-memory.dmpFilesize
392KB
-
memory/1268-147-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1268-138-0x0000000000000000-mapping.dmp
-
memory/1268-168-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/1340-72-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1340-66-0x0000000000000000-mapping.dmp
-
memory/1500-63-0x0000000000000000-mapping.dmp
-
memory/1500-73-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1624-96-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1624-87-0x0000000000000000-mapping.dmp
-
memory/1772-104-0x0000000000000000-mapping.dmp
-
memory/1772-106-0x0000000071951000-0x0000000071953000-memory.dmpFilesize
8KB
-
memory/1772-112-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1772-171-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1772-114-0x0000000024080000-0x00000000240E2000-memory.dmpFilesize
392KB
-
memory/1940-170-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1940-76-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1940-56-0x0000000000000000-mapping.dmp
-
memory/1992-54-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1992-55-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/1992-169-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2044-89-0x0000000000000000-mapping.dmp
-
memory/2044-98-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2060-149-0x0000000000000000-mapping.dmp
-
memory/2248-164-0x0000000000000000-mapping.dmp
-
memory/2280-156-0x0000000000000000-mapping.dmp
-
memory/2280-165-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/2280-167-0x0000000024160000-0x00000000241C2000-memory.dmpFilesize
392KB
-
memory/2508-166-0x0000000000000000-mapping.dmp
-
memory/2624-177-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2624-174-0x0000000000000000-mapping.dmp
-
memory/2676-183-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2676-180-0x0000000000000000-mapping.dmp
-
memory/2792-188-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2792-185-0x0000000000000000-mapping.dmp
-
memory/2832-193-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2832-190-0x0000000000000000-mapping.dmp
-
memory/2892-198-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2892-195-0x0000000000000000-mapping.dmp
-
memory/2932-200-0x0000000000000000-mapping.dmp
-
memory/2932-203-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2980-208-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB
-
memory/2980-205-0x0000000000000000-mapping.dmp
-
memory/3020-210-0x0000000000000000-mapping.dmp
-
memory/3020-213-0x0000000074840000-0x0000000074DEB000-memory.dmpFilesize
5.7MB