Overview
overview
10Static
static
10123.exe
windows7-x64
1123.exe
windows10-2004-x64
1360sb.exe
windows7-x64
10360sb.exe
windows10-2004-x64
107000.32
ubuntu-18.04-amd64
17000.64
ubuntu-18.04-amd64
7Linux577
ubuntu-18.04-amd64
8Mh.exe
windows7-x64
7Mh.exe
windows10-2004-x64
10Mh1.exe
windows7-x64
7Mh1.exe
windows10-2004-x64
10Mh2.exe
windows7-x64
7Mh2.exe
windows10-2004-x64
10SETUP.exe
windows7-x64
SETUP.exe
windows10-2004-x64
TX98
ubuntu-18.04-amd64
1TX981
ubuntu-18.04-amd64
1TX982
ubuntu-18.04-amd64
7TX984
debian-9-armhf
7TX985
debian-9-mipsel
7TX986
debian-9-mips
7bjyk.exe
windows7-x64
10bjyk.exe
windows10-2004-x64
10ceshi.exe
windows7-x64
10ceshi.exe
windows10-2004-x64
10ddos.exe
windows7-x64
1ddos.exe
windows10-2004-x64
10dhl.exe
windows7-x64
7dhl.exe
windows10-2004-x64
10mh3.exe
windows7-x64
7mh3.exe
windows10-2004-x64
10server.exe
windows7-x64
10Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 09:42
Behavioral task
behavioral1
Sample
123.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
123.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
360sb.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
360sb.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
7000.32
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral6
Sample
7000.64
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral7
Sample
Linux577
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral8
Sample
Mh.exe
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
Mh.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
Mh1.exe
Resource
win7-20230220-en
Behavioral task
behavioral11
Sample
Mh1.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
Mh2.exe
Resource
win7-20230220-en
Behavioral task
behavioral13
Sample
Mh2.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
SETUP.exe
Resource
win7-20230220-en
Behavioral task
behavioral15
Sample
SETUP.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
TX98
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral17
Sample
TX981
Resource
ubuntu1804-amd64-20221111-en
Behavioral task
behavioral18
Sample
TX982
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral19
Sample
TX984
Resource
debian9-armhf-20221111-en
Behavioral task
behavioral20
Sample
TX985
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral21
Sample
TX986
Resource
debian9-mipsbe-20221111-en
Behavioral task
behavioral22
Sample
bjyk.exe
Resource
win7-20230220-en
Behavioral task
behavioral23
Sample
bjyk.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral24
Sample
ceshi.exe
Resource
win7-20230220-en
Behavioral task
behavioral25
Sample
ceshi.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral26
Sample
ddos.exe
Resource
win7-20230220-en
Behavioral task
behavioral27
Sample
ddos.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral28
Sample
dhl.exe
Resource
win7-20230220-en
Behavioral task
behavioral29
Sample
dhl.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral30
Sample
mh3.exe
Resource
win7-20230220-en
Behavioral task
behavioral31
Sample
mh3.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral32
Sample
server.exe
Resource
win7-20230220-en
General
-
Target
dhl.exe
-
Size
311KB
-
MD5
1170aaabfc50ba1d8afd2bdd3fde5e33
-
SHA1
a345658edc7df429c515bc949d45661c7446136d
-
SHA256
022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
-
SHA512
333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
SSDEEP
6144:eKYOSlWhmtC3G/414qs8Pz5Trd8Coc1O9gRyBDqP6K0Q0wKnL:e1/WYtwG24Qp+oOGROrK0W0L
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
Processes:
dhl.exeTerms.EXETerms.EXETerms.EXEdescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications dhl.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\dhl.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dhl.exe:*:enabled:@shell32.dll,-1" dhl.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\Terms.EXE = "C:\\Windows\\SysWOW64\\Terms.EXE:*:enabled:@shell32.dll,-1" Terms.EXE Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\Terms.EXE = "C:\\Windows\\SysWOW64\\Terms.EXE:*:enabled:@shell32.dll,-1" Terms.EXE Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List dhl.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile dhl.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List Terms.EXE Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List Terms.EXE Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List Terms.EXE Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\Terms.EXE = "C:\\Windows\\SysWOW64\\Terms.EXE:*:enabled:@shell32.dll,-1" Terms.EXE -
ACProtect 1.3x - 1.4x DLL software 44 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\zki69FA.tmp acprotect C:\Users\Admin\AppData\Local\Temp\zki69FA.tmp acprotect C:\Windows\Temp\mni867A.tmp acprotect C:\Windows\Temp\mni867A.tmp acprotect C:\Windows\Temp\mni867A.tmp acprotect C:\Windows\Temp\api9F04.tmp acprotect C:\Windows\Temp\api9F04.tmp acprotect C:\Windows\Temp\tsiB6C2.tmp acprotect C:\Windows\Temp\tsiB6C2.tmp acprotect C:\Windows\Temp\buiCE13.tmp acprotect C:\Windows\Temp\buiCE13.tmp acprotect C:\Windows\Temp\qwiE5A2.tmp acprotect C:\Windows\Temp\qwiE5A2.tmp acprotect C:\Windows\Temp\bziFD12.tmp acprotect C:\Windows\Temp\bziFD12.tmp acprotect C:\Windows\Temp\bziFD12.tmp acprotect C:\Windows\Temp\bziFD12.tmp acprotect C:\Users\Admin\AppData\Local\Temp\zki69FA.tmp acprotect C:\Windows\Temp\aci1702.tmp acprotect C:\Windows\Temp\aci1702.tmp acprotect C:\Windows\Temp\gei2E44.tmp acprotect C:\Windows\Temp\gei2E44.tmp acprotect C:\Windows\Temp\vgi45D3.tmp acprotect C:\Windows\Temp\vgi45D3.tmp acprotect C:\Windows\Temp\gji5D43.tmp acprotect C:\Windows\Temp\gji5D43.tmp acprotect C:\Windows\Temp\rli74B3.tmp acprotect C:\Windows\Temp\rli74B3.tmp acprotect C:\Windows\Temp\boi8D0D.tmp acprotect C:\Windows\Temp\boi8D0D.tmp acprotect C:\Windows\Temp\pqiA49C.tmp acprotect C:\Windows\Temp\pqiA49C.tmp acprotect C:\Windows\Temp\zsiBBFD.tmp acprotect C:\Windows\Temp\zsiBBFD.tmp acprotect C:\Windows\Temp\kviD36D.tmp acprotect C:\Windows\Temp\kviD36D.tmp acprotect C:\Windows\Temp\jxiEA60.tmp acprotect C:\Windows\Temp\jxiEA60.tmp acprotect C:\Windows\Temp\xai2E9.tmp acprotect C:\Windows\Temp\xai2E9.tmp acprotect C:\Windows\Temp\ici1A59.tmp acprotect C:\Windows\Temp\ici1A59.tmp acprotect C:\Windows\Temp\sei31B9.tmp acprotect C:\Windows\Temp\sei31B9.tmp acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
dhl.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation dhl.exe -
Executes dropped EXE 24 IoCs
Processes:
Terms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEpid process 4660 Terms.EXE 2728 Terms.EXE 312 Terms.EXE 3824 Terms.EXE 4804 Terms.EXE 2372 Terms.EXE 2400 Terms.EXE 2868 Terms.EXE 1128 Terms.EXE 948 Terms.EXE 5008 Terms.EXE 2780 Terms.EXE 3024 Terms.EXE 2252 Terms.EXE 764 Terms.EXE 3888 Terms.EXE 3036 Terms.EXE 4148 Terms.EXE 3996 Terms.EXE 4776 Terms.EXE 4800 Terms.EXE 4864 Terms.EXE 1884 Terms.EXE 4372 Terms.EXE -
Loads dropped DLL 53 IoCs
Processes:
dhl.exeTerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEWerFault.exeWerFault.exeTerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEpid process 1224 dhl.exe 1224 dhl.exe 4660 Terms.EXE 4660 Terms.EXE 2728 Terms.EXE 2728 Terms.EXE 312 Terms.EXE 312 Terms.EXE 3824 Terms.EXE 3824 Terms.EXE 4804 Terms.EXE 4804 Terms.EXE 2372 Terms.EXE 2372 Terms.EXE 2948 WerFault.exe 2948 WerFault.exe 1872 WerFault.exe 2400 Terms.EXE 2400 Terms.EXE 2868 Terms.EXE 2868 Terms.EXE 1128 Terms.EXE 1128 Terms.EXE 948 Terms.EXE 948 Terms.EXE 5008 Terms.EXE 5008 Terms.EXE 2780 Terms.EXE 2780 Terms.EXE 3024 Terms.EXE 3024 Terms.EXE 2252 Terms.EXE 2252 Terms.EXE 764 Terms.EXE 764 Terms.EXE 3888 Terms.EXE 3888 Terms.EXE 3036 Terms.EXE 3036 Terms.EXE 4148 Terms.EXE 4148 Terms.EXE 3996 Terms.EXE 3996 Terms.EXE 4776 Terms.EXE 4776 Terms.EXE 4800 Terms.EXE 4800 Terms.EXE 4864 Terms.EXE 4864 Terms.EXE 1884 Terms.EXE 1884 Terms.EXE 4372 Terms.EXE 4372 Terms.EXE -
Processes:
resource yara_rule behavioral29/memory/1224-142-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/4660-157-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/1224-161-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/2728-169-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/4660-171-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/312-182-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/2728-184-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/3824-192-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/312-198-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/4804-201-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/3824-211-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/2372-226-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/4804-249-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/2400-260-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/2372-264-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/2868-274-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/2400-278-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/1128-288-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/948-302-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/1128-308-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/5008-320-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/948-328-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/2780-343-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/5008-349-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/3024-358-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/2780-364-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/2252-373-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/3024-379-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/764-388-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/2252-394-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/3888-404-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/3036-428-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/3888-432-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/4148-443-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/3036-449-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/3996-458-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/4148-464-0x0000000000400000-0x0000000000451000-memory.dmp upx C:\Windows\SysWOW64\Terms.EXE upx behavioral29/memory/4776-471-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/3996-477-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral29/memory/4800-487-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
dhl.exeTerms.EXETerms.EXETerms.EXEdescription ioc process File opened (read-only) \??\J: dhl.exe File opened (read-only) \??\K: dhl.exe File opened (read-only) \??\O: dhl.exe File opened (read-only) \??\Q: Terms.EXE File opened (read-only) \??\G: Terms.EXE File opened (read-only) \??\U: Terms.EXE File opened (read-only) \??\M: dhl.exe File opened (read-only) \??\L: Terms.EXE File opened (read-only) \??\R: Terms.EXE File opened (read-only) \??\Z: Terms.EXE File opened (read-only) \??\O: Terms.EXE File opened (read-only) \??\F: Terms.EXE File opened (read-only) \??\G: dhl.exe File opened (read-only) \??\L: dhl.exe File opened (read-only) \??\S: dhl.exe File opened (read-only) \??\K: Terms.EXE File opened (read-only) \??\U: Terms.EXE File opened (read-only) \??\X: Terms.EXE File opened (read-only) \??\P: Terms.EXE File opened (read-only) \??\Z: Terms.EXE File opened (read-only) \??\E: dhl.exe File opened (read-only) \??\X: dhl.exe File opened (read-only) \??\Y: dhl.exe File opened (read-only) \??\Z: dhl.exe File opened (read-only) \??\M: Terms.EXE File opened (read-only) \??\P: dhl.exe File opened (read-only) \??\K: Terms.EXE File opened (read-only) \??\S: Terms.EXE File opened (read-only) \??\J: Terms.EXE File opened (read-only) \??\J: Terms.EXE File opened (read-only) \??\H: Terms.EXE File opened (read-only) \??\N: Terms.EXE File opened (read-only) \??\U: Terms.EXE File opened (read-only) \??\N: Terms.EXE File opened (read-only) \??\Y: Terms.EXE File opened (read-only) \??\E: Terms.EXE File opened (read-only) \??\H: Terms.EXE File opened (read-only) \??\N: dhl.exe File opened (read-only) \??\W: dhl.exe File opened (read-only) \??\E: Terms.EXE File opened (read-only) \??\F: dhl.exe File opened (read-only) \??\L: Terms.EXE File opened (read-only) \??\N: Terms.EXE File opened (read-only) \??\W: Terms.EXE File opened (read-only) \??\Z: Terms.EXE File opened (read-only) \??\X: Terms.EXE File opened (read-only) \??\I: dhl.exe File opened (read-only) \??\F: Terms.EXE File opened (read-only) \??\I: Terms.EXE File opened (read-only) \??\M: Terms.EXE File opened (read-only) \??\Q: Terms.EXE File opened (read-only) \??\S: Terms.EXE File opened (read-only) \??\W: Terms.EXE File opened (read-only) \??\H: Terms.EXE File opened (read-only) \??\O: Terms.EXE File opened (read-only) \??\V: Terms.EXE File opened (read-only) \??\Y: Terms.EXE File opened (read-only) \??\V: dhl.exe File opened (read-only) \??\J: Terms.EXE File opened (read-only) \??\T: Terms.EXE File opened (read-only) \??\V: Terms.EXE File opened (read-only) \??\V: Terms.EXE File opened (read-only) \??\X: Terms.EXE File opened (read-only) \??\K: Terms.EXE -
Drops file in System32 directory 27 IoCs
Processes:
Terms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEdhl.exeTerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEdescription ioc process File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE dhl.exe File opened for modification C:\Windows\SysWOW64\Terms.EXE dhl.exe File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE dhl.exe File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE File created C:\Windows\SysWOW64\Terms.EXE Terms.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1872 1224 WerFault.exe dhl.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
dhl.exeTerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEpid process 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 4660 Terms.EXE 4660 Terms.EXE 4660 Terms.EXE 4660 Terms.EXE 2728 Terms.EXE 2728 Terms.EXE 312 Terms.EXE 312 Terms.EXE 3824 Terms.EXE 3824 Terms.EXE 4804 Terms.EXE 4804 Terms.EXE 1224 dhl.exe 1224 dhl.exe 2372 Terms.EXE 2372 Terms.EXE 2372 Terms.EXE 2372 Terms.EXE 2400 Terms.EXE 2400 Terms.EXE 2868 Terms.EXE 2868 Terms.EXE 1128 Terms.EXE 1128 Terms.EXE 948 Terms.EXE 948 Terms.EXE 5008 Terms.EXE 5008 Terms.EXE 5008 Terms.EXE 5008 Terms.EXE 2780 Terms.EXE 2780 Terms.EXE 3024 Terms.EXE 3024 Terms.EXE 2252 Terms.EXE 2252 Terms.EXE 764 Terms.EXE 764 Terms.EXE 3888 Terms.EXE 3888 Terms.EXE 3888 Terms.EXE 3888 Terms.EXE 3036 Terms.EXE 3036 Terms.EXE 4148 Terms.EXE 4148 Terms.EXE 3996 Terms.EXE 3996 Terms.EXE 4776 Terms.EXE 4776 Terms.EXE 4800 Terms.EXE 4800 Terms.EXE 4800 Terms.EXE 4800 Terms.EXE 4864 Terms.EXE 4864 Terms.EXE 1884 Terms.EXE 1884 Terms.EXE 4372 Terms.EXE 4372 Terms.EXE -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
dhl.exepid process 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe 1224 dhl.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
dhl.exeTerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEdescription pid process Token: SeDebugPrivilege 1224 dhl.exe Token: SeDebugPrivilege 4660 Terms.EXE Token: SeDebugPrivilege 2372 Terms.EXE Token: SeTakeOwnershipPrivilege 1224 dhl.exe Token: SeRestorePrivilege 1224 dhl.exe Token: SeBackupPrivilege 1224 dhl.exe Token: SeChangeNotifyPrivilege 1224 dhl.exe Token: SeDebugPrivilege 5008 Terms.EXE Token: SeDebugPrivilege 3888 Terms.EXE Token: SeDebugPrivilege 4800 Terms.EXE -
Suspicious use of SetWindowsHookEx 25 IoCs
Processes:
dhl.exeTerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXETerms.EXEpid process 1224 dhl.exe 4660 Terms.EXE 2728 Terms.EXE 312 Terms.EXE 3824 Terms.EXE 4804 Terms.EXE 2372 Terms.EXE 2400 Terms.EXE 2868 Terms.EXE 1128 Terms.EXE 948 Terms.EXE 5008 Terms.EXE 2780 Terms.EXE 3024 Terms.EXE 2252 Terms.EXE 764 Terms.EXE 3888 Terms.EXE 3036 Terms.EXE 4148 Terms.EXE 3996 Terms.EXE 4776 Terms.EXE 4800 Terms.EXE 4864 Terms.EXE 1884 Terms.EXE 4372 Terms.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dhl.exedescription pid process target process PID 1224 wrote to memory of 612 1224 dhl.exe winlogon.exe PID 1224 wrote to memory of 612 1224 dhl.exe winlogon.exe PID 1224 wrote to memory of 612 1224 dhl.exe winlogon.exe PID 1224 wrote to memory of 612 1224 dhl.exe winlogon.exe PID 1224 wrote to memory of 612 1224 dhl.exe winlogon.exe PID 1224 wrote to memory of 612 1224 dhl.exe winlogon.exe PID 1224 wrote to memory of 668 1224 dhl.exe lsass.exe PID 1224 wrote to memory of 668 1224 dhl.exe lsass.exe PID 1224 wrote to memory of 668 1224 dhl.exe lsass.exe PID 1224 wrote to memory of 668 1224 dhl.exe lsass.exe PID 1224 wrote to memory of 668 1224 dhl.exe lsass.exe PID 1224 wrote to memory of 668 1224 dhl.exe lsass.exe PID 1224 wrote to memory of 768 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 768 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 768 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 768 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 768 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 768 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 788 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 788 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 788 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 788 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 788 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 788 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 792 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 792 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 792 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 792 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 792 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 792 1224 dhl.exe fontdrvhost.exe PID 1224 wrote to memory of 880 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 880 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 880 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 880 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 880 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 880 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 940 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 940 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 940 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 940 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 940 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 940 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 1008 1224 dhl.exe dwm.exe PID 1224 wrote to memory of 1008 1224 dhl.exe dwm.exe PID 1224 wrote to memory of 1008 1224 dhl.exe dwm.exe PID 1224 wrote to memory of 1008 1224 dhl.exe dwm.exe PID 1224 wrote to memory of 1008 1224 dhl.exe dwm.exe PID 1224 wrote to memory of 1008 1224 dhl.exe dwm.exe PID 1224 wrote to memory of 436 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 436 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 436 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 436 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 436 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 436 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 724 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 724 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 724 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 724 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 724 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 724 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 784 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 784 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 784 1224 dhl.exe svchost.exe PID 1224 wrote to memory of 784 1224 dhl.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca2⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca2⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\dhl.exe"C:\Users\Admin\AppData\Local\Temp\dhl.exe"2⤵
- Modifies firewall policy service
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 18443⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1224 -ip 12242⤵
- Loads dropped DLL
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Modifies firewall policy service
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Terms.EXEC:\Windows\SysWOW64\Terms.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zki69FA.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\zki69FA.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Users\Admin\AppData\Local\Temp\zki69FA.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\SysWOW64\Terms.EXEFilesize
311KB
MD51170aaabfc50ba1d8afd2bdd3fde5e33
SHA1a345658edc7df429c515bc949d45661c7446136d
SHA256022600b997847cb9795b58cbef8b1058760d3037158f1d8890825f20e3f8745e
SHA512333c8e2af8f7b845abd897cd7d86ab68545ef2bddfda6f24216aa7fffeb39594756a666500fa3495205505bb485e4659c9e66f3c639d34bc12cf929b00950ea6
-
C:\Windows\Temp\aci1702.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\aci1702.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\api9F04.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\api9F04.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\boi8D0D.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\boi8D0D.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\buiCE13.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\buiCE13.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\bziFD12.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\bziFD12.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\bziFD12.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\bziFD12.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\gei2E44.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\gei2E44.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\gji5D43.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\gji5D43.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\ici1A59.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\ici1A59.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\jxiEA60.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\jxiEA60.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\kviD36D.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\kviD36D.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\mni867A.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\mni867A.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\mni867A.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\pqiA49C.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\pqiA49C.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\qwiE5A2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\qwiE5A2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\rli74B3.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\rli74B3.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\sei31B9.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\sei31B9.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\tsiB6C2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\tsiB6C2.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\vgi45D3.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\vgi45D3.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\xai2E9.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\xai2E9.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\zsiBBFD.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
C:\Windows\Temp\zsiBBFD.tmpFilesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
memory/312-182-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/312-198-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/312-183-0x0000000000D50000-0x0000000000DC3000-memory.dmpFilesize
460KB
-
memory/764-389-0x0000000000EE0000-0x0000000000F53000-memory.dmpFilesize
460KB
-
memory/764-388-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/948-328-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/948-302-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/948-303-0x0000000000D70000-0x0000000000DE3000-memory.dmpFilesize
460KB
-
memory/1128-289-0x0000000000930000-0x00000000009A3000-memory.dmpFilesize
460KB
-
memory/1128-288-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1128-308-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1224-159-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-143-0x0000000002210000-0x0000000002283000-memory.dmpFilesize
460KB
-
memory/1224-156-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-229-0x000000007FE20000-0x000000007FE2C000-memory.dmpFilesize
48KB
-
memory/1224-154-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-227-0x000000007FE20000-0x000000007FE2C000-memory.dmpFilesize
48KB
-
memory/1224-207-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/1224-233-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-160-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-139-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/1224-224-0x000000007FE20000-0x000000007FE2C000-memory.dmpFilesize
48KB
-
memory/1224-140-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/1224-161-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1224-234-0x000000007FE20000-0x000000007FE2C000-memory.dmpFilesize
48KB
-
memory/1224-225-0x000000007FE20000-0x000000007FE2C000-memory.dmpFilesize
48KB
-
memory/1224-145-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/1224-173-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-239-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-141-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/1224-155-0x000000007FE30000-0x000000007FE3C000-memory.dmpFilesize
48KB
-
memory/1224-142-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2252-373-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2252-374-0x0000000000D60000-0x0000000000DD3000-memory.dmpFilesize
460KB
-
memory/2252-394-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2372-226-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2372-264-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2372-228-0x0000000000E60000-0x0000000000ED3000-memory.dmpFilesize
460KB
-
memory/2400-278-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2400-261-0x0000000000DC0000-0x0000000000E33000-memory.dmpFilesize
460KB
-
memory/2400-260-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2400-322-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2400-335-0x0000000000DC0000-0x0000000000E33000-memory.dmpFilesize
460KB
-
memory/2400-336-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2728-169-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2728-170-0x00000000009C0000-0x0000000000A33000-memory.dmpFilesize
460KB
-
memory/2728-184-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2780-343-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2780-421-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2780-420-0x00000000008C0000-0x0000000000933000-memory.dmpFilesize
460KB
-
memory/2780-409-0x000000007FE40000-0x000000007FE4C000-memory.dmpFilesize
48KB
-
memory/2780-344-0x00000000008C0000-0x0000000000933000-memory.dmpFilesize
460KB
-
memory/2780-364-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/2868-275-0x00000000006D0000-0x0000000000743000-memory.dmpFilesize
460KB
-
memory/2868-274-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3024-359-0x0000000000DA0000-0x0000000000E13000-memory.dmpFilesize
460KB
-
memory/3024-379-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3024-358-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3036-449-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3036-428-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3036-429-0x0000000000DC0000-0x0000000000E33000-memory.dmpFilesize
460KB
-
memory/3824-211-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3824-193-0x0000000000610000-0x0000000000683000-memory.dmpFilesize
460KB
-
memory/3824-192-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3888-405-0x0000000000950000-0x00000000009C3000-memory.dmpFilesize
460KB
-
memory/3888-404-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3888-432-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3996-458-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/3996-459-0x0000000000920000-0x0000000000993000-memory.dmpFilesize
460KB
-
memory/3996-477-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4148-444-0x0000000000E50000-0x0000000000EC3000-memory.dmpFilesize
460KB
-
memory/4148-443-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4148-464-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4660-157-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4660-171-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4660-158-0x0000000000900000-0x0000000000973000-memory.dmpFilesize
460KB
-
memory/4776-472-0x0000000000D40000-0x0000000000DB3000-memory.dmpFilesize
460KB
-
memory/4776-471-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4800-488-0x0000000000DB0000-0x0000000000E23000-memory.dmpFilesize
460KB
-
memory/4800-487-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4804-208-0x0000000000DA0000-0x0000000000E13000-memory.dmpFilesize
460KB
-
memory/4804-249-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4804-201-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/5008-321-0x00000000005C0000-0x0000000000633000-memory.dmpFilesize
460KB
-
memory/5008-320-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/5008-349-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB