Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe
-
Size
794KB
-
MD5
f6fb5d75bf7566772a043526fc3a2508
-
SHA1
96bf4f9f083d3e290356fc9fc652fd10ea979997
-
SHA256
f9a216ea7cad2d3b950157140054a44be53208dadfb2cf370750e1d1b11ae3c9
-
SHA512
83a0cc2d06a7a76b40b601cbc667d00c7c9e977b2472258019dd30fb7d7604af6f58bd80655dc1789077f72e275a9b94eb98f90f98f54dfa3dc10ed024a4ecb0
-
SSDEEP
12288:FnQSEnzQ6FcnUqma7elTcqifgMUAzx7uokpnelS2RKFn9ReDxSbsOCSsuZ:JuzQq6UqwlTcqY7epnePd81NZ
Malware Config
Extracted
xtremerat
3r9-99.no-ip.org
Signatures
-
Detect XtremeRAT payload 49 IoCs
Processes:
resource yara_rule behavioral2/memory/3784-4-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3784-3-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3784-5-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3784-7-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1040-11-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3784-23-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1652-31-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1652-37-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1776-46-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1776-45-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1776-51-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/4828-58-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/4828-59-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/4828-65-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3728-74-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3728-79-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2136-88-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2136-94-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2340-102-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2340-107-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1512-116-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1512-121-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1884-130-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1884-135-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2972-143-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2972-148-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2936-155-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2936-156-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2936-161-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3980-170-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3980-175-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1968-184-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/1968-189-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3848-197-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3848-202-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/612-211-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/612-216-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3020-225-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3020-230-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2540-239-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2540-244-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2488-254-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2488-259-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3324-269-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3324-274-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2328-283-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/2328-289-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3740-299-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat behavioral2/memory/3740-304-0x0000000000C80000-0x0000000000C93000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry 2 TTPs 62 IoCs
Processes:
erxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exef6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5460C4DF-B266-909E-CB58-E32B79832EB2}\StubPath = "C:\\Windows\\InstallDir\\erxll.exe restart" erxll.exe -
Checks computer location settings 2 TTPs 30 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
erxll.exeerxll.exeerxll.exeerxll.exef6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation erxll.exe -
Deletes itself 1 IoCs
Processes:
explorer.exepid process 1040 explorer.exe -
Executes dropped EXE 60 IoCs
Processes:
erxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exepid process 2824 erxll.exe 1652 erxll.exe 2888 erxll.exe 1776 erxll.exe 924 erxll.exe 4828 erxll.exe 208 erxll.exe 3728 erxll.exe 3860 erxll.exe 2136 erxll.exe 4340 erxll.exe 2340 erxll.exe 2740 erxll.exe 1512 erxll.exe 2488 erxll.exe 1884 erxll.exe 3296 erxll.exe 2972 erxll.exe 3348 erxll.exe 2936 erxll.exe 3020 erxll.exe 3980 erxll.exe 3968 erxll.exe 1968 erxll.exe 2976 erxll.exe 3848 erxll.exe 4496 erxll.exe 612 erxll.exe 3060 erxll.exe 3020 erxll.exe 4168 erxll.exe 2540 erxll.exe 4064 erxll.exe 2488 erxll.exe 3348 erxll.exe 3324 erxll.exe 4064 erxll.exe 2328 erxll.exe 4072 erxll.exe 3740 erxll.exe 4784 erxll.exe 3468 erxll.exe 1932 erxll.exe 1104 erxll.exe 3548 erxll.exe 3620 erxll.exe 4388 erxll.exe 872 erxll.exe 3740 erxll.exe 2936 erxll.exe 3304 erxll.exe 2804 erxll.exe 4028 erxll.exe 4348 erxll.exe 3016 erxll.exe 2804 erxll.exe 4864 erxll.exe 2400 erxll.exe 5128 erxll.exe 5160 erxll.exe -
Adds Run key to start application 2 TTPs 62 IoCs
Processes:
erxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exef6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\erxl = "C:\\Windows\\InstallDir\\erxll.exe" erxll.exe -
Drops file in System32 directory 62 IoCs
Processes:
erxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exef6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exedescription ioc process File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File opened for modification C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe File created C:\Windows\SysWOW64\MSVBVM60.DLL erxll.exe -
Suspicious use of SetThreadContext 31 IoCs
Processes:
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exedescription pid process target process PID 1604 set thread context of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 2824 set thread context of 1652 2824 erxll.exe erxll.exe PID 2888 set thread context of 1776 2888 erxll.exe erxll.exe PID 924 set thread context of 4828 924 erxll.exe erxll.exe PID 208 set thread context of 3728 208 erxll.exe erxll.exe PID 3860 set thread context of 2136 3860 erxll.exe erxll.exe PID 4340 set thread context of 2340 4340 erxll.exe erxll.exe PID 2740 set thread context of 1512 2740 erxll.exe erxll.exe PID 2488 set thread context of 1884 2488 erxll.exe erxll.exe PID 3296 set thread context of 2972 3296 erxll.exe erxll.exe PID 3348 set thread context of 2936 3348 erxll.exe erxll.exe PID 3020 set thread context of 3980 3020 erxll.exe erxll.exe PID 3968 set thread context of 1968 3968 erxll.exe erxll.exe PID 2976 set thread context of 3848 2976 erxll.exe erxll.exe PID 4496 set thread context of 612 4496 erxll.exe erxll.exe PID 3060 set thread context of 3020 3060 erxll.exe erxll.exe PID 4168 set thread context of 2540 4168 erxll.exe erxll.exe PID 4064 set thread context of 2488 4064 erxll.exe erxll.exe PID 3348 set thread context of 3324 3348 erxll.exe erxll.exe PID 4064 set thread context of 2328 4064 erxll.exe erxll.exe PID 4072 set thread context of 3740 4072 erxll.exe erxll.exe PID 4784 set thread context of 3468 4784 erxll.exe erxll.exe PID 1932 set thread context of 1104 1932 erxll.exe erxll.exe PID 3548 set thread context of 3620 3548 erxll.exe erxll.exe PID 4388 set thread context of 872 4388 erxll.exe erxll.exe PID 3740 set thread context of 2936 3740 erxll.exe erxll.exe PID 3304 set thread context of 2804 3304 erxll.exe erxll.exe PID 4028 set thread context of 4348 4028 erxll.exe erxll.exe PID 3016 set thread context of 2804 3016 erxll.exe erxll.exe PID 4864 set thread context of 2400 4864 erxll.exe erxll.exe PID 5128 set thread context of 5160 5128 erxll.exe erxll.exe -
Drops file in Windows directory 2 IoCs
Processes:
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\InstallDir\erxll.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe File created C:\Windows\InstallDir\erxll.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
Processes:
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ = "DataObject" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8284B8A2-A8A8-11D1-A3D2-00A0C90AEA82}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib\Version = "6.0" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731} erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C} f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\TypeLib f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9} f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E469E0-BF61-11CF-8385-8F69D8F1350B}\ProxyStubClsid32 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag" erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C2-4442-11D1-8906-00A0C9110049}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\TypeLib f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\TypeLib f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{737361EC-467F-11D1-810F-0000F87557AA}\ProxyStubClsid32 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32 erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE8F9800-2AAA-11CF-AD67-00AA00614F3E}\ProxyStubClsid32 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7500A6BA-EB65-11D1-938D-0000F87557C9}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CBB76011-C508-11D1-A3E3-00A0C90AEA82}\TypeLib\Version = "6.0" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ = "_Collection" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731} erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ThreadingModel = "Apartment" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}\6.0\9\win32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL\\3" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ThreadingModel = "Apartment" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F1-7697-11D1-A1E9-00A0C90F2731}\TypeLib f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45046D60-08CA-11CF-A90F-00AA0062BB4C}\TypeLib\Version = "6.0" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4495AD01-C993-11D1-A3E4-00A0C90AEA82}\ = "_PropertyBag" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A7D760-6018-11CF-9016-00AA0068841E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C5-4442-11D1-8906-00A0C9110049}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\ = "VBPropertyBag" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ThreadingModel = "Apartment" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\TypeLib\Version = "6.0" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EB41E8C3-4442-11D1-8906-00A0C9110049} f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C49FF0-B294-11D0-9488-00A0C91110ED}\TypeLib\ = "{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCFB3D2B-A0FA-1068-A738-08002B3371B5}\TypeLib\Version = "6.0" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ = "C:\\Windows\\SysWow64\\MSVBVM60.DLL" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ThreadingModel = "Apartment" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}\InProcServer32\ThreadingModel = "Apartment" erxll.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A4C46780-499F-101B-BB78-00AA00383CBB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B28FA150-0FF0-11CF-A911-00AA0062BB4C}\ProxyStubClsid32 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4E0F020-720A-11CF-8136-00AA00C14959}\ = "DataBindings" f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4D651F2-7697-11D1-A1E9-00A0C90F2731}\TypeLib f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 31 IoCs
Processes:
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exeerxll.exepid process 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe 2824 erxll.exe 2888 erxll.exe 924 erxll.exe 208 erxll.exe 3860 erxll.exe 4340 erxll.exe 2740 erxll.exe 2488 erxll.exe 3296 erxll.exe 3348 erxll.exe 3020 erxll.exe 3968 erxll.exe 2976 erxll.exe 4496 erxll.exe 3060 erxll.exe 4168 erxll.exe 4064 erxll.exe 3348 erxll.exe 4064 erxll.exe 4072 erxll.exe 4784 erxll.exe 1932 erxll.exe 3548 erxll.exe 4388 erxll.exe 3740 erxll.exe 3304 erxll.exe 4028 erxll.exe 3016 erxll.exe 4864 erxll.exe 5128 erxll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exef6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeerxll.exeerxll.exedescription pid process target process PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 1604 wrote to memory of 3784 1604 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe PID 3784 wrote to memory of 4204 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4204 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 1040 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe explorer.exe PID 3784 wrote to memory of 1040 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe explorer.exe PID 3784 wrote to memory of 1040 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe explorer.exe PID 3784 wrote to memory of 1040 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe explorer.exe PID 3784 wrote to memory of 4204 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2212 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2212 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2212 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4384 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4384 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4384 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4644 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4644 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4644 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2668 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2668 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2668 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 3424 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 3424 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 3424 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2952 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2952 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2952 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4376 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 4376 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe msedge.exe PID 3784 wrote to memory of 2824 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe erxll.exe PID 3784 wrote to memory of 2824 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe erxll.exe PID 3784 wrote to memory of 2824 3784 f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 2824 wrote to memory of 1652 2824 erxll.exe erxll.exe PID 1652 wrote to memory of 4812 1652 erxll.exe msedge.exe PID 1652 wrote to memory of 4812 1652 erxll.exe msedge.exe PID 1652 wrote to memory of 4812 1652 erxll.exe msedge.exe PID 1652 wrote to memory of 544 1652 erxll.exe msedge.exe PID 1652 wrote to memory of 544 1652 erxll.exe msedge.exe PID 1652 wrote to memory of 544 1652 erxll.exe msedge.exe PID 1652 wrote to memory of 3156 1652 erxll.exe msedge.exe PID 1652 wrote to memory of 3156 1652 erxll.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\f6fb5d75bf7566772a043526fc3a2508_JaffaCakes118.exe2⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Deletes itself
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe4⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe6⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"7⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe8⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"9⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe10⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"11⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe12⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"13⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe14⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"15⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe16⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"17⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe18⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"19⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe20⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"21⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe22⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"23⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"23⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe24⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"25⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"25⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe26⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"27⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"27⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe28⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"29⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"29⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe30⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"31⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe32⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"33⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"33⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe34⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"35⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe36⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"37⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"37⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe38⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"39⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe40⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"41⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe42⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"43⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"43⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe44⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"45⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe46⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"47⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"47⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe48⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"49⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe50⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"51⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe52⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"53⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe54⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"55⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe56⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"57⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe58⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"59⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe60⤵
- Modifies Installed Components in the registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"61⤵
-
C:\Windows\InstallDir\erxll.exe"C:\Windows\InstallDir\erxll.exe"61⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\InstallDir\erxll.exeC:\Windows\InstallDir\erxll.exe62⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"63⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"63⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\((Mutex)).cfgFilesize
1KB
MD5530fc5e399b10fa79e72af28634c5a52
SHA1541d97e40da58fbc59074849639548f2f4083b50
SHA2562e9e82cfdaf61a4cca91bad42f31da60d1098489593e841c4e8d9f5bf0595702
SHA512c3dec8bb5da7150a9de6a5155f8a092534dc05d364e8fc4227e64e278b3e7bb8c659c302a953e3f0f3d38f423281ab94925868ab9528c4ed39d428f920477d5d
-
C:\Windows\InstallDir\erxll.exeFilesize
794KB
MD5f6fb5d75bf7566772a043526fc3a2508
SHA196bf4f9f083d3e290356fc9fc652fd10ea979997
SHA256f9a216ea7cad2d3b950157140054a44be53208dadfb2cf370750e1d1b11ae3c9
SHA51283a0cc2d06a7a76b40b601cbc667d00c7c9e977b2472258019dd30fb7d7604af6f58bd80655dc1789077f72e275a9b94eb98f90f98f54dfa3dc10ed024a4ecb0
-
memory/208-66-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/208-73-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/612-216-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/612-211-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/924-60-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/924-52-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/1040-11-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1512-116-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1512-121-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1604-6-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/1604-0-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/1652-31-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1652-37-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1776-46-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1776-45-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1776-51-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1884-135-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1884-130-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1968-189-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/1968-184-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2136-94-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2136-88-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2328-283-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2328-289-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2340-102-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2340-107-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2488-122-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2488-129-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2488-254-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2488-259-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2540-244-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2540-239-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2740-114-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2740-108-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2824-22-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2824-30-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2888-38-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2888-44-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/2936-156-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2936-161-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2936-155-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2972-148-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2972-143-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/2976-195-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3020-225-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3020-162-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3020-168-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3020-230-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3060-224-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3296-141-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3324-274-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3324-269-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3348-268-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3348-153-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3348-260-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3728-79-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3728-74-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3740-304-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3740-299-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3784-3-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3784-7-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3784-23-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3784-4-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3784-5-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3848-202-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3848-197-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3860-86-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3860-80-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3968-176-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3968-183-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/3980-175-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/3980-170-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/4064-253-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4064-245-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4064-284-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4064-275-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4072-290-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4072-298-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4168-238-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4340-100-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4340-93-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4496-209-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4496-203-0x0000000000400000-0x000000000050D000-memory.dmpFilesize
1.1MB
-
memory/4828-58-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/4828-59-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB
-
memory/4828-65-0x0000000000C80000-0x0000000000C93000-memory.dmpFilesize
76KB