Malware Analysis Report

2025-01-22 13:17

Sample ID 241208-bkq68azkep
Target MALZ6.zip
SHA256 c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099
Tags
antivm defense_evasion discovery persistence upx gh0strat evasion rat bootkit mrblack rootkit botnet trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099

Threat Level: Known bad

The file MALZ6.zip was found to be: Known bad.

Malicious Activity Summary

antivm defense_evasion discovery persistence upx gh0strat evasion rat bootkit mrblack rootkit botnet trojan

MrBlack Trojan

Modifies firewall policy service

MrBlack trojan

Mrblack family

Gh0strat family

Gh0st RAT payload

Gh0strat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Identifies Wine through registry keys

File and Directory Permissions Modification

Loads a kernel module

ACProtect 1.3x - 1.4x DLL software

Write file to user bin folder

Adds Run key to start application

Reads system routing table

Writes file to system bin folder

Modifies init.d

Writes to the Master Boot Record (MBR)

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in System32 directory

Reads system network configuration

Checks CPU configuration

Drops file in Windows directory

Drops file in Program Files directory

Program crash

Browser Information Discovery

Reads runtime system information

Unsigned PE

Enumerates physical storage devices

Writes file to tmp directory

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious behavior: MapViewOfSection

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-08 01:12

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat family

gh0strat

MrBlack trojan

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Mrblack family

mrblack

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

ubuntu2204-amd64-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

[/tmp/06432]

Signatures

File and Directory Permissions Modification

defense_evasion
Description Indicator Process Target
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A

Executes dropped EXE

Description Indicator Process Target
N/A /usr/bin/bsd-port/getty /usr/bin/bsd-port/getty N/A
N/A /etc/ssh/bashpa /etc/ssh/bashpa N/A

Modifies init.d

persistence
Description Indicator Process Target
File opened for modification /etc/init.d/DbSecuritySpt /tmp/06432 N/A
File opened for modification /etc/init.d/selinux /usr/bin/bsd-port/getty N/A

Reads system routing table

discovery
Description Indicator Process Target
File opened for reading /proc/net/route /tmp/06432 N/A

Write file to user bin folder

persistence
Description Indicator Process Target
File opened for modification /usr/bin/bsd-port/udevd.lock /tmp/06432 N/A
File opened for modification /usr/bin/bsd-port/getty /usr/bin/cp N/A
File opened for modification /usr/bin/bsd-port/getty.lock /usr/bin/bsd-port/getty N/A
File opened for modification /usr/bin/dpkgd/lsof /usr/bin/cp N/A
File opened for modification /usr/bin/dpkgd/ps /usr/bin/cp N/A
File opened for modification /usr/bin/lsof /usr/bin/cp N/A
File opened for modification /usr/bin/ps /usr/bin/cp N/A
File opened for modification /usr/bin/bsd-port/getty.lock /tmp/06432 N/A

Writes file to system bin folder

Description Indicator Process Target
File opened for modification /bin/lsof /usr/bin/cp N/A
File opened for modification /bin/ps /usr/bin/cp N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Checks CPU configuration

antivm
Description Indicator Process Target
File opened for reading /proc/cpuinfo /tmp/06432 N/A
File opened for reading /proc/cpuinfo /usr/bin/bsd-port/getty N/A

Reads system network configuration

discovery
Description Indicator Process Target
File opened for reading /proc/net/dev /tmp/06432 N/A
File opened for reading /proc/net/route /tmp/06432 N/A
File opened for reading /proc/net/arp /tmp/06432 N/A
File opened for reading /proc/net/dev /usr/bin/bsd-port/getty N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/sys/kernel/version /tmp/06432 N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/sys/kernel/version /etc/ssh/bashpa N/A
File opened for reading /proc/stat /tmp/06432 N/A
File opened for reading /proc/meminfo /tmp/06432 N/A
File opened for reading /proc/cmdline /usr/sbin/insmod N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/cmdline /usr/sbin/insmod N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/sys/kernel/version /usr/bin/bsd-port/getty N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/stat /usr/bin/bsd-port/getty N/A
File opened for reading /proc/meminfo /usr/bin/bsd-port/getty N/A

Writes file to tmp directory

Description Indicator Process Target
File opened for modification /tmp/gates.lock /etc/ssh/bashpa N/A
File opened for modification /tmp/moni.lock /tmp/06432 N/A
File opened for modification /tmp/bill.lock /tmp/06432 N/A
File opened for modification /tmp/gates.lock /tmp/06432 N/A
File opened for modification /tmp/notify.file /tmp/06432 N/A
File opened for modification /tmp/conf.n /tmp/06432 N/A
File opened for modification /tmp/moni.lock /etc/ssh/bashpa N/A
File opened for modification /tmp/notify.file /etc/ssh/bashpa N/A

Processes

/tmp/06432

[/tmp/06432]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt]

/bin/sh

[sh -c mkdir -p /usr/bin/bsd-port]

/usr/bin/mkdir

[mkdir -p /usr/bin/bsd-port]

/bin/sh

[sh -c cp -f /tmp/06432 /usr/bin/bsd-port/getty]

/usr/bin/cp

[cp -f /tmp/06432 /usr/bin/bsd-port/getty]

/bin/sh

[sh -c /usr/bin/bsd-port/getty]

/usr/bin/bsd-port/getty

[/usr/bin/bsd-port/getty]

/bin/sh

[sh -c mkdir -p /etc/ssh]

/usr/bin/mkdir

[mkdir -p /etc/ssh]

/bin/sh

[sh -c cp -f /tmp/06432 /etc/ssh/bashpa]

/usr/bin/cp

[cp -f /tmp/06432 /etc/ssh/bashpa]

/bin/sh

[sh -c /etc/ssh/bashpa]

/etc/ssh/bashpa

[/etc/ssh/bashpa]

/bin/sh

[sh -c insmod /usr/lib/xpacket.ko]

/usr/sbin/insmod

[insmod /usr/lib/xpacket.ko]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux]

/bin/sh

[sh -c mkdir -p /usr/bin/dpkgd]

/usr/bin/mkdir

[mkdir -p /usr/bin/dpkgd]

/bin/sh

[sh -c cp -f /bin/lsof /usr/bin/dpkgd/lsof]

/usr/bin/cp

[cp -f /bin/lsof /usr/bin/dpkgd/lsof]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /bin/lsof]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /bin/lsof]

/bin/sh

[sh -c chmod 0755 /bin/lsof]

/usr/bin/chmod

[chmod 0755 /bin/lsof]

/bin/sh

[sh -c cp -f /bin/ps /usr/bin/dpkgd/ps]

/usr/bin/cp

[cp -f /bin/ps /usr/bin/dpkgd/ps]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /bin/ps]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /bin/ps]

/bin/sh

[sh -c chmod 0755 /bin/ps]

/usr/bin/chmod

[chmod 0755 /bin/ps]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /usr/bin/lsof]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /usr/bin/lsof]

/bin/sh

[sh -c chmod 0755 /usr/bin/lsof]

/usr/bin/chmod

[chmod 0755 /usr/bin/lsof]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /usr/bin/ps]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /usr/bin/ps]

/bin/sh

[sh -c chmod 0755 /usr/bin/ps]

/usr/bin/chmod

[chmod 0755 /usr/bin/ps]

/bin/sh

[sh -c insmod /usr/lib/xpacket.ko]

/usr/sbin/insmod

[insmod /usr/lib/xpacket.ko]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
CN 119.147.139.228:36000 tcp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
CN 119.147.139.228:36000 tcp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp
US 8.8.8.8:53 linux.dj6cc.com udp

Files

memory/1596-1-0x0000000008048000-0x0000000008129e8c-memory.dmp

/tmp/gates.lock

MD5 87ec2f451208df97228105657edb717f
SHA1 3738f2650c3885bee794953d56a1e91a5516f93f
SHA256 eb57f949956cc9f3c32eb7f249bbe56a74c253015af4dddb0c98cde49157cbd0
SHA512 ed0b97c0e93e6fea48a3038fe6a19f5083f8e81575d5e27472e7f40d9cca795ef6ab7440acedb4a7837623e9ef21f635f782067d411ee428e7690d3ffe6644ea

/etc/init.d/DbSecuritySpt

MD5 48dab32d26db5bf4a05140b06c745ab9
SHA1 a4f0d81fbbbbee256b4337e5775865680c0d63a6
SHA256 7b0c9ce02a8992a99c6b7d60607a112205483c024474942d7cad1741400310ce
SHA512 d624971593d8f117666cbc378b612c34b007b8c2390f7cd256b35cbbcfe1c7a3ac6115c167e394fc4bccfae57579ffae0a8a83cae894f737c15b77735f6e30af

/usr/bin/bsd-port/getty

MD5 9a51d462452001e1f04dd68cf4336c54
SHA1 594d570708fa03d0ab37a0306b38c134be90becc
SHA256 7b06be1d204ee0b5ebc0d4cb287133b796bb28b18414ce3b1e8d31691db8b172
SHA512 e89c9abca2fce011ecade9763fdf738af4b642d5bad22af9a78b25e6a229409b1cb823e446569f7d647ccdd88f6d55094bcf7f4c591951d01f72b7b6d8e4deb6

memory/1638-2-0x0000000008048000-0x0000000008129e8c-memory.dmp

/tmp/notify.file

MD5 14a74da1c3ed51e7744747af12724a92
SHA1 d66cbc587968d8cad15c34e09782bcffe283deae
SHA256 fd71ae4560d140229377c2e4f2eccfc759a4c3eb8c6dd81e5697e33b6ecfb896
SHA512 2a484a97808d68ee644e4162773c8540602aefce1764a449ff987ca89de77da4d166601d5893c8342969974dff3e4913d479a2b98f66acd38a75fbb719311119

memory/1646-3-0x0000000008048000-0x0000000008129e8c-memory.dmp

/etc/init.d/selinux

MD5 993cc15058142d96c3daf7852c3d5ee8
SHA1 0950b8b391b04dd3895ea33cd3141543ebd2525d
SHA256 8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA512 0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

/tmp/conf.n

MD5 5d3d128f1b932142cdc67365e42a6fd5
SHA1 95a1566f0df9cc0857b389ab0285a778f0fb0e55
SHA256 344444f85c309bc9fd45233857e0bbb62dc549b49abf4cfc3af8d62a1ea1e222
SHA512 4f7485ce2ef5fca45c7d1b6a9301f2b0a43b2a125f39c0f9c303cba4f3532cff3eef8ba241870c0744898db07e40dae9dd81538082a1258a5493e6bd6e836206

/usr/bin/dpkgd/lsof

MD5 ab57b66cc531ae0f996963223e632b60
SHA1 bf7e5becd33f21c2539f5a75ffa0ab61c49c8795
SHA256 2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df
SHA512 908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

/usr/bin/dpkgd/ps

MD5 8146139c2ad7e550b1d1f49480997446
SHA1 074db8890c3227bd8a588417f5b9bde637bcf3af
SHA256 207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f
SHA512 b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de

/tmp/moni.lock

MD5 8d420fa35754d1f1c19969c88780314d
SHA1 b1d2f044e12dcb7cdd594a29701421711464cede
SHA256 920232613e4a67a07d6c99b7974dbcd6765ee171da73e4961e1499a05a1f471b
SHA512 4ae489c0b5faa148721d69e59718436a3766f0479833decd3c946247fa8c319ed9bd98823bbda7f916b9f1460412cd964c9e75868a83105d0ffb5b4cd55f0f79

Analysis: behavioral4

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240903-en

Max time kernel

118s

Max time network

134s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1.html

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a84ab7548c1ff84f908e1efed9d563b90000000002000000000010660000000100002000000062a82ba84a834f6823dc76be3d7b54e8de2889982943c7c5aff6ec131e8448fa000000000e80000000020000200000005d0d2d9355e7d4df11c8ed684b7c9980264dedd4559b24c19280dc5c6187a57f20000000f3cc004ce07bdc6f1ddf43d434c40d726c59e307145391ca5c9e81cc15612820400000002ef51c24161315b0b898649a267b49e6a9c72ec12bf85c955733e771f551e9b916c79d7745e02be7fc8821ec9a60fedf4ce8c189e8a5e325a8d5df6ef2609714 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AA59971-B501-11EF-928D-EE9D5ADBD8E3} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a84ab7548c1ff84f908e1efed9d563b900000000020000000000106600000001000020000000c58edc33240e107d7c974ec4283670cc5eeece55358920a499b1f0fda567a92e000000000e80000000020000200000004a3e63f7ef89267e68884f091c38b5f956c109accdce1c2e5fd2151ada0d3a8590000000b50b1bf5d216f9895a5afcca499fccb9b151111e3391bbf5e0687063ed2966e7c236c10b53800930023225eb15ada0e79903b7104ae49f10e372a19d43cb6549d2bfba29558608201df6c97da696af46a81e3b297c26e8fa4bec801f9b50a68a721ed38bd3f88da48fef6ebcb82c5d8034b54642370a406c0553fcf3ea57183792308100cba6eb8a1ba152c8d6d3bc9340000000a2c2294d64d218d09633b0d9b3c02e7b3215194e351e3202996efbdeb0b75ec2ecbea14c5af0952c3cbcbb1c5f66f43022950769459c0f2ebe64cb7c6fc532a1 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439782237" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e4375f0e49db01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabE69B.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarE749.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52146362b0960265867680c0c3f66e4f
SHA1 483509c1e2a219a0bbfaf1063406d48ddb57e59a
SHA256 1e5ec00bd936f8589dd2ecf6f0554b3b66e2d5a19b4836c24366f16bb991a44c
SHA512 5ba24b11252478a75538e14d66606ece039e4e3ff5ef3033b032519622f8a4955f0772c5a9266dce70a8bca09fcd5e97bdfb2244dc7200d31e9508c665332e7c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 674fc8bc593be7aa75c82e9904f2e011
SHA1 eccfee23f7f22530d3cbea8b8ce07df85301d6ba
SHA256 06e18283ea1c9e241e14df947535ca6f9aea144112463a47b3c09963fba034ef
SHA512 1232af5e6e022c2bcf670a130b450f3b56c89809e8db9292c96aa02ce43746854e855508b2235276ede44dcf96fbb850dee5de15b8c04a7c7043716b4f9b5065

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7e8c72455b4f418c9a9ab8063ebff1ad
SHA1 34f43c6ec5272f579e09bbbf69fbf811dad94b0e
SHA256 b7bc276fcf40cd7342831b37680a7873940de2f723568c90461caebfe3245a5c
SHA512 ab6522b4aab9c94c07a7d6ad344a9633b8ed285702b0569f1d5708d0b1db275eb44bc430ee76ccf66a1692a23058ea2d7f3512594c2bcf0db8bf4868a947f15c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a9710771643e4150c7b3dc6bbfc3eb7
SHA1 696b96dc0ec7c6a497a4446e75b71d2c9de4767e
SHA256 58b1c9dd4db8faf528de410d1ebcec0573383dbd3ba1006fe0102002211836a2
SHA512 5f96f0897351dd94cce1d4b88d74dbc1501f236d19f57826c293d834cc700e0471423ae116f0c81c6c1a0bc93df8e14ccd7676082070cdad89207867f93e0bd6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6d2442e7f1da9b635404fea078765450
SHA1 f84f605db7dcea010a8c26ff7b3d56e254d57dab
SHA256 2c26611ec94ede7f2d9f19b8bce7e7058adb1cdff1c83b9f78489cf4f20609ce
SHA512 d378a81b6717543cfa552c2b73340d83e18e39d69c22c4abe2d3bac68ee265d805327f5bae9720901d59253f6c6459f36b987d4c08d2387fc99034f434d8b705

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fdbca4d4db5a2787762f4efc8a20c9ab
SHA1 674178489d1608391182a2def8b5f1f37e31793f
SHA256 9ceea4714689c40d6c6f934abb6e598da1ba020684eec1e631e06f229ccb3be9
SHA512 ebee45683af49b1bf54de0380524cdc7e95db9e33e4e98cffafc64f116ccda2594306efdfe08324861e03c013d362b7190d0f1c11d1400e4b9fcc3c2fa41c66d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 73ef6aca8e8c19931a25c1e04efcedf9
SHA1 ff4666b0376d6b152f666d21b4b0f48acfa6d5c7
SHA256 ff1119e632df53dd0d9fad129767f2a9fff2bbc0e075ba3d35eed7bd884d80f8
SHA512 a723dfca62b6cd7a8b9c0c834b028ce91e6157a5e94a83fc8aab339742015ed2bb7849f383a252e38ece803a101204218d10eefd536c1afce753c99ae558d36d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 eab37a0c4b6b5ad22edd184ce8682566
SHA1 b1e19f3834c5d4e11247f21c77bacb370c2dacbf
SHA256 b961daeeb1f7dd45ebf2a17c48e47a38b4ef7cba0238de0a0f9166ec19fea33c
SHA512 82b0fa72c7aa8bbe29824836067d698b4ea5bd870cc5a186d4646b659f7fd7443a80a23f1db34319d8d60073ac9807e15a4aaa4157cdacdc437e5446bbd35d78

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ec1d1e53705dfc7cf3844235d8f0d04
SHA1 89d1b0cf854745862129bdca3441bcb433d3eeab
SHA256 be3a3de791e6e46b4c438ec7f0955ec1cc0f1ce7d18a5e45760d70a0f94f3948
SHA512 288718c929067927c64a2bae1b51d8d7799b353ed87f1b5ea9a030629856b6a4fd8c77d7c43e8f3c487d015e10066636ed87b8e610b29e9a13b9356b8baf8564

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e104c5ba9d26bb4243e8256576f6ce6e
SHA1 6feb4df149635c425de6591e9fcc4222a2c90ccb
SHA256 c8b20800a263c56cd2a784ab96e59666ec759c4ce76bc1ded9b80b021a49d6c8
SHA512 e9bea2696ee0f3be09c0ec2dbd1cb421a0c6d55da2b5031f8463f2f9fd373f581b1c7ca36c946abe94ff9f622987d943abeba7dd5df31002971ed3b49b99d04c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 14f3e203f158e5a6760bd2efb717206e
SHA1 ef46553a0db963b25fa78fc258c024211de82a61
SHA256 0c91726d450c3c6040dfc6a759b05d060b076e274ed85836572816eeb9be4949
SHA512 ecdfa1686b011e58edb36a6bc7185ee037f9a84032e122799fae5e2eb7546b3483fbf1a6fb0244b02d5165f82a080a3f04dabd780596fcbeb3ad9ac18121cd50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0dce7830cdb4f1aa31043607272dc2ef
SHA1 f51642b03e2e9af5cc29bb00f0a45d118a3bb7a1
SHA256 af3e054e0e4397fde622469b243b89c43f14419cc949b99075376dfd39de67cb
SHA512 5c10167dc59e71400bcf7ad385a3057be80b33000abc63026bf5fc9b86088a31f8e509cd584e824b4ca7dff4f3e8058e89954eef39b3e88790bd3eda40556de5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8c7c39043d813fd525bff48594abb380
SHA1 9b43ef4e1cc2b240d9ea01c61fa6615c070eee5c
SHA256 4d168e206f889861533feaa7b3a3bf0b18baa1bbf2691f2343f61f1e31d9a1b7
SHA512 68eeb0a7a344d329a4353ca45f1053843c3f75e8ed7650f5d91fa90cc8d0e4e449782344ef12c5f8ab179bd5935bbffb63a358bf89cf778f7954f1dd4ab42f88

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8690a785bca621485e67a1aa986ddcb1
SHA1 a75254c595369e540615789abe0a2fed0713ab3c
SHA256 61735c0451ece75f816e5c012a31ab9c61dc147aa6a257266aa8715ed59ca575
SHA512 9b5226a78287a6b3d77cfb51f78206db273c5a1e58dcd737f243cae22d921c5737a70d75f13d3bdebd39e55f3644f17b7b78fbd1c921f46a64665b129fc21fcc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ba95f5284c8ec5e5deff0005950144c
SHA1 843190253937a4af701c9c8f29ac2a02578df8e7
SHA256 97fdce9c71dfa8ce58b7b92179b75e6e3ebc12c4a7c8f8a88dc8feb693cdaf79
SHA512 233189ab364b38e66de25796229a06afb13be92d4490ad606458f874585e6efa352008b42dafa6d992c80a53441a30ca0c26727bbb88e346843bea7f3a87c1fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8c92390c76b127f236ba10af31a67511
SHA1 83b5c52854196e1659e86a592236c65838b9a0d2
SHA256 6c9948e24747b48789492e89e1d478af9b3e21979e82fb18cc2a9d9c242d2d01
SHA512 b7639c1839cd1439daa863d3a7d929074afc44af4df3102eb16e9f7eb991a91924041dc09a18613baccd4650800accb7d6f34348e46bebbb5b89810ad296ea6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59303431d5e6bb441fb9083b4c73c4d9
SHA1 dbdba23569dafc6b82fc8f764cffcca4e3045bdf
SHA256 edd6bf7fb7fe0f59b8020b52bf8c12082cb547b7f25f527bcdba568c6ac99dc7
SHA512 5af31dd18a3dfd40b18e134b057abb699310a2b9d8a737f69f0f921fb49d3e402051d7e4cdbe105ff090e13470dc54294d16e05bcc5b9a03625cad40f13566f2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9370311f117edf8478778e3e7d3ab55f
SHA1 4f974a60b5e1cf01ff66cbb81ab7c6c05c45deda
SHA256 65cc0d412dc18721359177f987be872aca18b510bd152321beb956ceccee8238
SHA512 1a8df9347e2bf2f5f7b702fe6a531325cc4bd60d37840baf81ad0423a5006cb6f7b953e05bb154911bd1ef9f1980e5c78d74feb488a050d962648ea0931357ba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc2c49dda53ca7c7bc6fbe6d9af8672b
SHA1 835553bde632d18d626e473b6c44f06170094b53
SHA256 32d426a7a4efc1876484d832b3ee429d86a11423075f2328d39c03661cc10aed
SHA512 796a760203bce96cb183f5721dd2dc718aa4ebde5088730b092a319dc62ab084807b06cc126def2c1ea1588988c07d3d80fab6a12de4234aad9378ecde97d71c

Analysis: behavioral17

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

96s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2972 wrote to memory of 3208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2972 wrote to memory of 3208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2972 wrote to memory of 3208 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

winlogon.exe

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\HkMh.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HkMh.exe:*:enabled:@shell32.dll,-1" C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1092 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 1092 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 1092 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 1092 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 1092 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 1092 wrote to memory of 612 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 1092 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 1092 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 1092 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 1092 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 1092 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 1092 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 1092 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\fontdrvhost.exe
PID 1092 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\dwm.exe
PID 1092 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\dwm.exe
PID 1092 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\dwm.exe
PID 1092 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\dwm.exe
PID 1092 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\dwm.exe
PID 1092 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\dwm.exe
PID 1092 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 1092 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 1092 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 1092 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 1092 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 1092 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 1092 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 1092 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\HkMh.exe

"C:\Users\Admin\AppData\Local\Temp\HkMh.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 zebing520.vicp.cc udp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 83.133.119.197:80 tcp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
US 8.8.8.8:53 ilo.brenz.pl udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
US 8.8.8.8:53 ant.trenz.pl udp
DE 83.133.119.197:80 tcp
US 8.8.8.8:53 tneyox.com udp
US 8.8.8.8:53 lezchb.com udp
US 8.8.8.8:53 uoxfaq.com udp
US 8.8.8.8:53 wgyuml.com udp
US 8.8.8.8:53 kgajqf.com udp
US 8.8.8.8:53 ahzyce.com udp
US 8.8.8.8:53 osiiey.com udp
US 8.8.8.8:53 pzekml.com udp
US 8.8.8.8:53 btostu.com udp
US 8.8.8.8:53 ykwgmt.com udp
US 8.8.8.8:53 srbdoc.com udp
US 8.8.8.8:53 ruvffx.com udp
US 8.8.8.8:53 eeogah.com udp
US 8.8.8.8:53 uiqaug.com udp
US 8.8.8.8:53 oeyade.com udp
US 8.8.8.8:53 wkuoib.com udp
US 8.8.8.8:53 hcyhfb.com udp
US 8.8.8.8:53 iesukf.com udp
US 8.8.8.8:53 djbudo.com udp
US 8.8.8.8:53 ceydtd.com udp
US 8.8.8.8:53 iymooo.com udp
US 8.8.8.8:53 gucszx.com udp
US 8.8.8.8:53 ljfkup.com udp
US 8.8.8.8:53 qkzqkv.com udp
US 8.8.8.8:53 joiele.com udp
US 8.8.8.8:53 ezjeig.com udp
US 8.8.8.8:53 zmvoaj.com udp
US 8.8.8.8:53 yeelxh.com udp
US 8.8.8.8:53 gpauha.com udp
US 8.8.8.8:53 nyvgju.com udp
US 8.8.8.8:53 guupxr.com udp
US 8.8.8.8:53 alkfii.com udp
US 8.8.8.8:53 rnoofh.com udp
US 8.8.8.8:53 ncqfho.com udp
US 8.8.8.8:53 otnotl.com udp
US 8.8.8.8:53 dlzive.com udp
US 8.8.8.8:53 jgkkum.com udp
US 8.8.8.8:53 ruiiio.com udp
US 8.8.8.8:53 qyurao.com udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 zbwsqh.com udp
US 8.8.8.8:53 qapjie.com udp
US 8.8.8.8:53 ndvwao.com udp
US 8.8.8.8:53 nwnaoz.com udp
US 8.8.8.8:53 sfupuz.com udp
US 8.8.8.8:53 bnrsss.com udp
US 8.8.8.8:53 fzfdti.com udp
US 8.8.8.8:53 wgskqq.com udp
US 8.8.8.8:53 veoaaa.com udp
US 8.8.8.8:53 pnrppp.com udp
US 8.8.8.8:53 iqeluj.com udp
US 8.8.8.8:53 vzvjnx.com udp
US 8.8.8.8:53 wiuffk.com udp
US 8.8.8.8:53 mjtwkd.com udp
US 8.8.8.8:53 gtixdw.com udp
US 8.8.8.8:53 idaaad.com udp
US 8.8.8.8:53 etytwk.com udp
US 8.8.8.8:53 ofxxqy.com udp
US 8.8.8.8:53 xxtzaa.com udp
US 8.8.8.8:53 uiujkk.com udp
US 8.8.8.8:53 ivizpb.com udp
US 8.8.8.8:53 vdoird.com udp
US 8.8.8.8:53 ocyilo.com udp
US 8.8.8.8:53 dtfxwq.com udp
US 8.8.8.8:53 imycik.com udp
US 8.8.8.8:53 poijph.com udp
US 8.8.8.8:53 eeopsu.com udp
US 8.8.8.8:53 hetjkv.com udp
US 8.8.8.8:53 puniad.com udp
US 8.8.8.8:53 aqawrm.com udp
US 8.8.8.8:53 ahwnvn.com udp
US 8.8.8.8:53 cgggeo.com udp
US 8.8.8.8:53 jgciio.com udp
US 8.8.8.8:53 bfxedg.com udp
US 8.8.8.8:53 oklyhx.com udp
US 8.8.8.8:53 qlquwm.com udp
US 8.8.8.8:53 wtaorj.com udp
US 8.8.8.8:53 hfimxs.com udp
US 8.8.8.8:53 yanbrs.com udp
US 8.8.8.8:53 hyanjt.com udp
US 8.8.8.8:53 gvmwly.com udp
US 8.8.8.8:53 aghoiz.com udp
US 8.8.8.8:53 fyzpnk.com udp
US 8.8.8.8:53 hefhhu.com udp
US 8.8.8.8:53 viknee.com udp
US 8.8.8.8:53 nyyaaa.com udp
US 8.8.8.8:53 rvozym.com udp
US 8.8.8.8:53 deujdt.com udp
US 8.8.8.8:53 kwajja.com udp
US 8.8.8.8:53 pckkrm.com udp
US 8.8.8.8:53 afdxyq.com udp
US 8.8.8.8:53 ykuzbe.com udp
US 8.8.8.8:53 umjuvt.com udp
US 8.8.8.8:53 fluucg.com udp
US 8.8.8.8:53 imzqxz.com udp
US 8.8.8.8:53 luzbid.com udp
US 185.230.63.107:443 luzbid.com tcp
US 8.8.8.8:53 107.63.230.185.in-addr.arpa udp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
US 8.8.8.8:53 ukkbpv.com udp
US 8.8.8.8:53 biyacg.com udp
US 8.8.8.8:53 espchh.com udp
US 8.8.8.8:53 nbompz.com udp
US 8.8.8.8:53 ulijyj.com udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 83.133.119.197:80 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
N/A 127.0.0.1:8888 tcp

Files

memory/1092-0-0x0000000000400000-0x000000000042C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\griAB44.tmp

MD5 685f1cbd4af30a1d0c25f252d399a666
SHA1 6a1b978f5e6150b88c8634146f1406ed97d2f134
SHA256 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA512 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

memory/1092-5-0x0000000002170000-0x00000000021E3000-memory.dmp

memory/1092-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1092-10-0x0000000076EE3000-0x0000000076EE4000-memory.dmp

memory/1092-9-0x0000000076EE2000-0x0000000076EE3000-memory.dmp

memory/1092-11-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1092-12-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1092-13-0x0000000010000000-0x0000000010024000-memory.dmp

memory/1092-17-0x0000000000400000-0x000000000042C000-memory.dmp

memory/1092-18-0x0000000002170000-0x00000000021E3000-memory.dmp

memory/1092-26-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1092-27-0x0000000002170000-0x00000000021E3000-memory.dmp

Analysis: behavioral24

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240903-en

Max time kernel

150s

Max time network

153s

Command Line

wininit.exe

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Cntvs_Me_Please = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HkMh_2.exe" C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 268 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\wininit.exe
PID 268 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\wininit.exe
PID 268 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\wininit.exe
PID 268 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\wininit.exe
PID 268 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\wininit.exe
PID 268 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\wininit.exe
PID 268 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\wininit.exe
PID 268 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\csrss.exe
PID 268 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\csrss.exe
PID 268 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\csrss.exe
PID 268 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\csrss.exe
PID 268 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\csrss.exe
PID 268 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\csrss.exe
PID 268 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\csrss.exe
PID 268 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 268 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 268 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 268 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 268 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 268 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 268 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 268 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\services.exe
PID 268 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\services.exe
PID 268 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\services.exe
PID 268 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\services.exe
PID 268 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\services.exe
PID 268 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\services.exe
PID 268 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\services.exe
PID 268 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 268 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 268 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 268 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 268 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 268 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 268 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 268 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsm.exe
PID 268 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsm.exe
PID 268 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsm.exe
PID 268 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsm.exe
PID 268 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsm.exe
PID 268 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsm.exe
PID 268 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsm.exe
PID 268 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 268 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 268 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 268 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 268 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 268 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 268 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 268 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 268 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe

"C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.mddos.com udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 3.19.116.195:1380 www.mddos.com tcp
US 3.19.116.195:1380 www.mddos.com tcp
US 8.8.8.8:53 www.mddos.com udp
US 3.18.7.81:1380 www.mddos.com tcp
US 8.8.8.8:53 www.mddos.com udp
US 3.94.41.167:1380 www.mddos.com tcp
US 3.94.41.167:1380 www.mddos.com tcp
US 3.94.41.167:1380 www.mddos.com tcp
US 8.8.8.8:53 www.mddos.com udp
US 3.94.41.167:1380 www.mddos.com tcp
US 3.94.41.167:1380 tcp

Files

memory/268-0-0x0000000000400000-0x0000000000412000-memory.dmp

\Users\Admin\AppData\Local\Temp\dvlD920.tmp

MD5 685f1cbd4af30a1d0c25f252d399a666
SHA1 6a1b978f5e6150b88c8634146f1406ed97d2f134
SHA256 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA512 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

memory/268-4-0x0000000000350000-0x00000000003C3000-memory.dmp

memory/268-6-0x0000000077330000-0x0000000077331000-memory.dmp

memory/268-5-0x000000007732F000-0x0000000077330000-memory.dmp

memory/268-7-0x0000000000350000-0x00000000003C3000-memory.dmp

memory/268-14-0x0000000000400000-0x0000000000412000-memory.dmp

memory/268-15-0x0000000000350000-0x00000000003C3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe

"C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/1520-0-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-1-0x00000000776E4000-0x00000000776E6000-memory.dmp

memory/1520-14-0x0000000000401000-0x0000000000461000-memory.dmp

memory/1520-13-0x00000000049B0000-0x00000000049B1000-memory.dmp

memory/1520-12-0x0000000004980000-0x0000000004981000-memory.dmp

memory/1520-11-0x00000000048F0000-0x00000000048F1000-memory.dmp

memory/1520-10-0x00000000048D0000-0x00000000048D1000-memory.dmp

memory/1520-9-0x00000000049C0000-0x00000000049C1000-memory.dmp

memory/1520-8-0x0000000004910000-0x0000000004911000-memory.dmp

memory/1520-7-0x0000000004900000-0x0000000004902000-memory.dmp

memory/1520-6-0x0000000004940000-0x0000000004941000-memory.dmp

memory/1520-5-0x00000000048E0000-0x00000000048E1000-memory.dmp

memory/1520-4-0x0000000004960000-0x0000000004961000-memory.dmp

memory/1520-3-0x0000000004920000-0x0000000004921000-memory.dmp

memory/1520-2-0x0000000004930000-0x0000000004931000-memory.dmp

memory/1520-15-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-16-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-17-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-18-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-19-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-20-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-21-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-22-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-24-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1520-26-0x0000000000400000-0x00000000006DF000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20241010-en

Max time kernel

133s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\520.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\AppPatch\NetSyst76.dll C:\Users\Admin\AppData\Local\Temp\520.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\520.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\520.exe

"C:\Users\Admin\AppData\Local\Temp\520.exe"

Network

Country Destination Domain Proto
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp

Files

N/A

Analysis: behavioral13

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\711.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\DbProtectSupport\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DbProtectSupport\svchost.exe.bak C:\Users\Admin\AppData\Local\Temp\711.exe N/A
File created C:\Program Files\DbProtectSupport\svchost.exe C:\Users\Admin\AppData\Local\Temp\711.exe N/A
File opened for modification C:\Program Files\DbProtectSupport\svchost.exe C:\Users\Admin\AppData\Local\Temp\711.exe N/A
File opened for modification C:\Program Files\DbProtectSupport\fake.cfg C:\Program Files\DbProtectSupport\svchost.exe N/A
File created C:\Program Files\DbProtectSupport\fake.cfg C:\Program Files\DbProtectSupport\svchost.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\711.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files\DbProtectSupport\svchost.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\DbProtectSupport\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\DbProtectSupport\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Program Files\DbProtectSupport\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Program Files\DbProtectSupport\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\711.exe

"C:\Users\Admin\AppData\Local\Temp\711.exe"

C:\Program Files\DbProtectSupport\svchost.exe

"C:\Program Files\DbProtectSupport\svchost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 104.243.24.148:10711 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 104.243.24.148:10711 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 104.243.24.148:10711 tcp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 104.243.24.148:10711 tcp
US 104.243.24.148:10711 tcp

Files

C:\Program Files\DbProtectSupport\svchost.exe

MD5 ad2f49936bd8ec7d2c29b1e1e1bef158
SHA1 98a439f9d809724ff0fb212fa30e3723db54bc25
SHA256 0b30fb669ca7be52298c3769467f3c84666b6ebead9b71858ed193eebef5da1a
SHA512 c57db44e7400de825441bf276b2266651fc1eb339dead9746d0c3d45bf12a88a7025cc9628673806e05f171d2f97b5b0909479c64867361649c81d50a04cffe1

Analysis: behavioral19

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

153s

Command Line

winlogon.exe

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\umqeiy.exe = "C:\\Windows\\umqeiy.exe:*:enabled:@shell32.dll,-1" C:\Windows\umqeiy.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A
File opened for modification C:\Windows\SysWOW64\hra33.dll C:\Windows\umqeiy.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\umqeiy.exe C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
File opened for modification C:\Windows\umqeiy.exe C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\FUCK360.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\umqeiy.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\umqeiy.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A
N/A N/A C:\Windows\umqeiy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 736 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 736 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 736 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 736 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 736 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 736 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 736 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 736 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 736 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 736 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 736 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 736 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 736 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\fontdrvhost.exe
PID 736 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\dwm.exe
PID 736 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\dwm.exe
PID 736 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\dwm.exe
PID 736 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\dwm.exe
PID 736 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\dwm.exe
PID 736 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\dwm.exe
PID 736 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 508 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 736 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 736 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 736 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 736 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 736 wrote to memory of 860 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 736 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 736 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Users\Admin\AppData\Local\Temp\FUCK360.exe

"C:\Users\Admin\AppData\Local\Temp\FUCK360.exe"

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 736 -ip 736

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1712

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\System32\WaaSMedicAgent.exe

C:\Windows\System32\WaaSMedicAgent.exe f5ed7c128717a45e72259e1aada5bd11 R8Yiulew0U2f7OQHzJ7SWA.0.1.0.0.0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

C:\Windows\umqeiy.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 8.173.189.20.in-addr.arpa udp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
DE 88.198.69.43:80 tcp

Files

memory/736-0-0x0000000000400000-0x0000000000418000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\uoi8CCF.tmp

MD5 685f1cbd4af30a1d0c25f252d399a666
SHA1 6a1b978f5e6150b88c8634146f1406ed97d2f134
SHA256 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA512 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

memory/736-7-0x0000000002190000-0x0000000002203000-memory.dmp

memory/736-5-0x0000000002190000-0x0000000002203000-memory.dmp

memory/736-10-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/736-11-0x00000000775E3000-0x00000000775E4000-memory.dmp

memory/736-9-0x00000000775E2000-0x00000000775E3000-memory.dmp

memory/736-12-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/736-13-0x000000007FE40000-0x000000007FE4C000-memory.dmp

C:\Windows\umqeiy.exe

MD5 7ab51c2e2fdac53f3360bb5c8b73734e
SHA1 076d233ef06971a64f9b009c03627a491444a422
SHA256 8a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216
SHA512 35a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee

memory/4472-24-0x0000000000D70000-0x0000000000DE3000-memory.dmp

memory/4472-23-0x0000000000D70000-0x0000000000DE3000-memory.dmp

memory/736-27-0x000000007FE30000-0x000000007FE3C000-memory.dmp

memory/736-26-0x000000007FE30000-0x000000007FE3C000-memory.dmp

memory/736-25-0x000000007FE30000-0x000000007FE3C000-memory.dmp

C:\Windows\Temp\goi923E.tmp

MD5 06be485186b658a88dfb242611651506
SHA1 bcdfb1d45086ba1bfac457b3007ccd4b870091a0
SHA256 33b73b618d55a90d2a20e4a3abfdc4abdc24a39105b849b3074c4601b4fd65bf
SHA512 63c896d37800f1f0dd50f92c23665f7030c9a5954b25a2e7286059acfc6aed12446566c83feb4b3c822680a6d3d91bf6746006f3fdd109e2ae993e2d2c3e8bfe

C:\Windows\SysWOW64\hra33.dll

MD5 aabeb05e642b2f9acb86a5dc1a600813
SHA1 abba695b782c0e644b971b65d4dc7b8349714488
SHA256 8b1d4870fdc940da538f225251996794f2f10ab7fff718d1aa884be8468dcfce
SHA512 730fd04e4624f4db8c7c92e786148139d457c5bdc28badb3b1cbb70b61fd7b20655c2feab90c5c91b0d30f42a2d7bccb2ce0120752e223e6df2139c371b4be8a

memory/4472-46-0x0000000000D70000-0x0000000000DE3000-memory.dmp

memory/4472-45-0x0000000000400000-0x0000000000418000-memory.dmp

memory/736-48-0x000000007FE30000-0x000000007FE3C000-memory.dmp

memory/736-51-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/736-54-0x0000000002190000-0x0000000002203000-memory.dmp

memory/736-55-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2664-63-0x0000000000670000-0x00000000006E3000-memory.dmp

memory/2664-62-0x0000000000670000-0x00000000006E3000-memory.dmp

memory/2664-66-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/2664-65-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/2664-64-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/2664-82-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/2664-85-0x0000000000670000-0x00000000006E3000-memory.dmp

memory/2664-86-0x0000000000400000-0x0000000000418000-memory.dmp

memory/1268-94-0x00000000005C0000-0x0000000000633000-memory.dmp

memory/1268-93-0x00000000005C0000-0x0000000000633000-memory.dmp

memory/1268-95-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1268-96-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1268-97-0x000000007FE40000-0x000000007FE4C000-memory.dmp

C:\Windows\Temp\csiB41E.tmp

MD5 088d5d421f7024ae0e53e8f1bf7d00d6
SHA1 992dedc0b60f70d48c790202c795935e5f8d16b2
SHA256 9546105854a396028596b3caf7e2ba3eb51a0795f16b6ad84e46afd00efd65df
SHA512 5389a025e51ed9031ebec5fcdd01b7012e0ffb6283ba772b1fb2963734ff4bda33791c388ad8df529b6a944ca9cbe0d825fd784e22bfcf3c6486a7692946936a

C:\RCXB41F.tmp

MD5 056588be5f0740dce439dee300cd6280
SHA1 64b5833cd9ec2eb41c91acff2af878b11d7beb50
SHA256 66e27ae4cbd3ea341542c40fc80507afd7a20371a8231787f96e090c7cab9453
SHA512 84a14876d42a8514cfd2458d2b1f589898ecc7f92c13d577cc367784aba6493df86a21b24b54b8761c19db9c250b425c1e63b41f3fc36e94c123720a1b70eac8

memory/1268-113-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1268-116-0x00000000005C0000-0x0000000000633000-memory.dmp

memory/1268-117-0x0000000000400000-0x0000000000418000-memory.dmp

memory/624-125-0x0000000000D40000-0x0000000000DB3000-memory.dmp

memory/624-124-0x0000000000D40000-0x0000000000DB3000-memory.dmp

memory/624-126-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/624-127-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/624-128-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/624-143-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/624-146-0x0000000000D40000-0x0000000000DB3000-memory.dmp

memory/624-147-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3964-155-0x0000000000580000-0x00000000005F3000-memory.dmp

memory/3964-154-0x0000000000580000-0x00000000005F3000-memory.dmp

memory/3964-156-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3964-157-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3964-158-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3964-174-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3964-177-0x0000000000580000-0x00000000005F3000-memory.dmp

memory/3964-178-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3860-186-0x00000000005A0000-0x0000000000613000-memory.dmp

memory/3860-185-0x00000000005A0000-0x0000000000613000-memory.dmp

memory/3860-187-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3860-188-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3860-189-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3860-205-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3860-208-0x00000000005A0000-0x0000000000613000-memory.dmp

memory/3860-209-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4628-217-0x0000000000770000-0x00000000007E3000-memory.dmp

memory/4628-216-0x0000000000770000-0x00000000007E3000-memory.dmp

memory/4628-218-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4628-219-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4628-220-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4628-236-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/4628-240-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4628-239-0x0000000000770000-0x00000000007E3000-memory.dmp

memory/3456-247-0x0000000000D60000-0x0000000000DD3000-memory.dmp

memory/3456-249-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3456-248-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3456-250-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3456-266-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/3456-269-0x0000000000D60000-0x0000000000DD3000-memory.dmp

memory/3456-270-0x0000000000400000-0x0000000000418000-memory.dmp

memory/5080-278-0x00000000004C0000-0x0000000000533000-memory.dmp

memory/5080-277-0x00000000004C0000-0x0000000000533000-memory.dmp

memory/5080-279-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/5080-301-0x0000000000400000-0x0000000000418000-memory.dmp

memory/5080-302-0x00000000004C0000-0x0000000000533000-memory.dmp

memory/984-310-0x0000000000CF0000-0x0000000000D63000-memory.dmp

memory/984-309-0x0000000000CF0000-0x0000000000D63000-memory.dmp

memory/984-333-0x0000000000400000-0x0000000000418000-memory.dmp

memory/984-334-0x0000000000CF0000-0x0000000000D63000-memory.dmp

memory/184-341-0x00000000004A0000-0x0000000000513000-memory.dmp

memory/184-342-0x00000000004A0000-0x0000000000513000-memory.dmp

memory/184-365-0x0000000000400000-0x0000000000418000-memory.dmp

memory/184-366-0x00000000004A0000-0x0000000000513000-memory.dmp

memory/1424-374-0x00000000004B0000-0x0000000000523000-memory.dmp

memory/1424-373-0x00000000004B0000-0x0000000000523000-memory.dmp

memory/1424-397-0x0000000000400000-0x0000000000418000-memory.dmp

memory/1424-398-0x00000000004B0000-0x0000000000523000-memory.dmp

memory/3588-403-0x0000000000570000-0x00000000005E3000-memory.dmp

memory/3588-402-0x0000000000570000-0x00000000005E3000-memory.dmp

memory/3588-423-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3588-424-0x0000000000570000-0x00000000005E3000-memory.dmp

memory/4592-429-0x0000000000570000-0x00000000005E3000-memory.dmp

memory/4592-428-0x0000000000570000-0x00000000005E3000-memory.dmp

memory/4592-449-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4592-450-0x0000000000570000-0x00000000005E3000-memory.dmp

memory/4028-454-0x0000000000D10000-0x0000000000D83000-memory.dmp

memory/4028-455-0x0000000000D10000-0x0000000000D83000-memory.dmp

memory/4028-476-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4028-477-0x0000000000D10000-0x0000000000D83000-memory.dmp

memory/2624-482-0x0000000000D20000-0x0000000000D93000-memory.dmp

memory/2624-481-0x0000000000D20000-0x0000000000D93000-memory.dmp

memory/2624-502-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2624-503-0x0000000000D20000-0x0000000000D93000-memory.dmp

memory/1192-508-0x0000000000D10000-0x0000000000D83000-memory.dmp

memory/1192-507-0x0000000000D10000-0x0000000000D83000-memory.dmp

memory/1192-530-0x0000000000D10000-0x0000000000D83000-memory.dmp

memory/1192-529-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2848-535-0x0000000000D60000-0x0000000000DD3000-memory.dmp

memory/2848-534-0x0000000000D60000-0x0000000000DD3000-memory.dmp

memory/2848-556-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2848-557-0x0000000000D60000-0x0000000000DD3000-memory.dmp

memory/908-562-0x0000000000CD0000-0x0000000000D43000-memory.dmp

memory/908-561-0x0000000000CD0000-0x0000000000D43000-memory.dmp

memory/908-583-0x0000000000400000-0x0000000000418000-memory.dmp

memory/908-584-0x0000000000CD0000-0x0000000000D43000-memory.dmp

memory/1788-589-0x0000000000560000-0x00000000005D3000-memory.dmp

memory/1788-588-0x0000000000560000-0x00000000005D3000-memory.dmp

memory/1788-610-0x0000000000400000-0x0000000000418000-memory.dmp

memory/1788-611-0x0000000000560000-0x00000000005D3000-memory.dmp

memory/2992-615-0x0000000000CD0000-0x0000000000D43000-memory.dmp

memory/2992-636-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2992-637-0x0000000000CD0000-0x0000000000D43000-memory.dmp

memory/4984-641-0x0000000000CD0000-0x0000000000D43000-memory.dmp

memory/4984-662-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4984-663-0x0000000000CD0000-0x0000000000D43000-memory.dmp

memory/3848-668-0x0000000000D40000-0x0000000000DB3000-memory.dmp

memory/3848-667-0x0000000000D40000-0x0000000000DB3000-memory.dmp

memory/3848-689-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3848-690-0x0000000000D40000-0x0000000000DB3000-memory.dmp

memory/4092-695-0x0000000000E40000-0x0000000000EB3000-memory.dmp

memory/4092-694-0x0000000000E40000-0x0000000000EB3000-memory.dmp

memory/4092-716-0x0000000000400000-0x0000000000418000-memory.dmp

memory/4092-717-0x0000000000E40000-0x0000000000EB3000-memory.dmp

memory/2136-721-0x0000000000D20000-0x0000000000D93000-memory.dmp

memory/2136-742-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2136-743-0x0000000000D20000-0x0000000000D93000-memory.dmp

memory/4992-747-0x0000000000D20000-0x0000000000D93000-memory.dmp

Analysis: behavioral20

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GetPass.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\GetPass.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GetPass.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GetPass.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\GetPass.exe

"C:\Users\Admin\AppData\Local\Temp\GetPass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 164

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\GetPass.exe"

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\GetPass.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GetPass.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\GetPass.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\GetPass.exe

"C:\Users\Admin\AppData\Local\Temp\GetPass.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4916 -ip 4916

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4916 -s 320

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:12

Platform

win10v2004-20241007-en

Max time kernel

0s

Max time network

1s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

133s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\518_2.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\AppPatch\NetSyst76.dll C:\Users\Admin\AppData\Local\Temp\518_2.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\518_2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\518_2.exe

"C:\Users\Admin\AppData\Local\Temp\518_2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 181.129.81.91.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\10711.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10711.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10711.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\10711.exe

"C:\Users\Admin\AppData\Local\Temp\10711.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240903-en

Max time kernel

150s

Max time network

154s

Command Line

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\gkmiuy.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
File created C:\Windows\SysWOW64\hra33.dll C:\Windows\gkmiuy.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\gkmiuy.exe C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
File opened for modification C:\Windows\gkmiuy.exe C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\gkmiuy.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\gkmiuy.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe N/A
N/A N/A C:\Windows\gkmiuy.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3068 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\csrss.exe
PID 3068 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\csrss.exe
PID 3068 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\csrss.exe
PID 3068 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\csrss.exe
PID 3068 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\csrss.exe
PID 3068 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\csrss.exe
PID 3068 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\csrss.exe
PID 3068 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\wininit.exe
PID 3068 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\wininit.exe
PID 3068 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\wininit.exe
PID 3068 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\wininit.exe
PID 3068 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\wininit.exe
PID 3068 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\wininit.exe
PID 3068 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\wininit.exe
PID 3068 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 3068 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 3068 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 3068 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 3068 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 3068 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 3068 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\winlogon.exe
PID 3068 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\services.exe
PID 3068 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\services.exe
PID 3068 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\services.exe
PID 3068 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\services.exe
PID 3068 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\services.exe
PID 3068 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\services.exe
PID 3068 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\services.exe
PID 3068 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 3068 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 3068 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 3068 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 3068 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 3068 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 3068 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsass.exe
PID 3068 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsm.exe
PID 3068 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsm.exe
PID 3068 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsm.exe
PID 3068 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsm.exe
PID 3068 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsm.exe
PID 3068 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsm.exe
PID 3068 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\lsm.exe
PID 3068 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\system32\svchost.exe
PID 3068 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 3068 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 3068 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 3068 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 3068 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 3068 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 3068 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe
PID 3068 wrote to memory of 808 N/A C:\Users\Admin\AppData\Local\Temp\FUCK360.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\FUCK360.exe

"C:\Users\Admin\AppData\Local\Temp\FUCK360.exe"

C:\Windows\gkmiuy.exe

C:\Windows\gkmiuy.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 wls.lyjq.org udp

Files

memory/3068-0-0x0000000000400000-0x0000000000418000-memory.dmp

memory/3068-4-0x0000000001BF0000-0x0000000001C63000-memory.dmp

\Users\Admin\AppData\Local\Temp\tol91C4.tmp

MD5 685f1cbd4af30a1d0c25f252d399a666
SHA1 6a1b978f5e6150b88c8634146f1406ed97d2f134
SHA256 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA512 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

memory/3068-7-0x0000000077910000-0x0000000077911000-memory.dmp

memory/3068-6-0x000000007790F000-0x0000000077910000-memory.dmp

C:\Windows\gkmiuy.exe

MD5 7ab51c2e2fdac53f3360bb5c8b73734e
SHA1 076d233ef06971a64f9b009c03627a491444a422
SHA256 8a7ad72fd6d3936ea3ad0ecadc063b382c6f0f8ff65b4839df1f3169f0135216
SHA512 35a6247f16a0295140782d0ea73754a37aafa09ba62d1f2be0a822d7f1b548921bad94b563ff16f1c817060544560f3c66856f0a85862cdbdfd85e29462abfee

memory/2164-13-0x0000000000350000-0x00000000003C3000-memory.dmp

memory/3068-14-0x0000000077910000-0x0000000077911000-memory.dmp

memory/3068-16-0x000000007EF90000-0x000000007EF9C000-memory.dmp

memory/3068-15-0x000000007790F000-0x0000000077910000-memory.dmp

memory/3068-19-0x0000000001BF0000-0x0000000001C63000-memory.dmp

memory/3068-20-0x000000007EF90000-0x000000007EF9C000-memory.dmp

memory/3068-18-0x0000000000400000-0x0000000000418000-memory.dmp

C:\Windows\Temp\ool9493.tmp

MD5 06be485186b658a88dfb242611651506
SHA1 bcdfb1d45086ba1bfac457b3007ccd4b870091a0
SHA256 33b73b618d55a90d2a20e4a3abfdc4abdc24a39105b849b3074c4601b4fd65bf
SHA512 63c896d37800f1f0dd50f92c23665f7030c9a5954b25a2e7286059acfc6aed12446566c83feb4b3c822680a6d3d91bf6746006f3fdd109e2ae993e2d2c3e8bfe

\Windows\SysWOW64\hra33.dll

MD5 aabeb05e642b2f9acb86a5dc1a600813
SHA1 abba695b782c0e644b971b65d4dc7b8349714488
SHA256 8b1d4870fdc940da538f225251996794f2f10ab7fff718d1aa884be8468dcfce
SHA512 730fd04e4624f4db8c7c92e786148139d457c5bdc28badb3b1cbb70b61fd7b20655c2feab90c5c91b0d30f42a2d7bccb2ce0120752e223e6df2139c371b4be8a

memory/2164-35-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2164-36-0x0000000000350000-0x00000000003C3000-memory.dmp

memory/2164-39-0x0000000000350000-0x00000000003C3000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

ubuntu2404-amd64-20240523-en

Max time kernel

149s

Max time network

153s

Command Line

[/tmp/TSmm]

Signatures

Loads a kernel module

rootkit
Description Indicator Process Target
N/A N/A /tmp/TSmm N/A

Processes

/tmp/TSmm

[/tmp/TSmm]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 104.243.24.148:10711 tcp
US 104.243.24.148:10711 tcp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

143s

Command Line

winlogon.exe

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HkMh_3.exe:*:enabled:@shell32.dll,-1" C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\lqrjma.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\lqrjma.exe C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
File opened for modification C:\Windows\SysWOW64\lqrjma.exe C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\lqrjma.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Windows\SysWOW64\lqrjma.exe N/A
N/A N/A C:\Windows\SysWOW64\lqrjma.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\lqrjma.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1696 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 1696 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 1696 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 1696 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 1696 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 1696 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 1696 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 1696 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 1696 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 1696 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 1696 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 1696 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 1696 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\fontdrvhost.exe
PID 1696 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\dwm.exe
PID 1696 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\dwm.exe
PID 1696 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\dwm.exe
PID 1696 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\dwm.exe
PID 1696 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\dwm.exe
PID 1696 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\dwm.exe
PID 1696 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 1696 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 1696 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 1696 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 1696 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 1696 wrote to memory of 1040 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 1696 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 1696 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe

"C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe"

C:\Windows\SysWOW64\lqrjma.exe

C:\Windows\SysWOW64\lqrjma.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 180.129.81.91.in-addr.arpa udp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 mhyk.lyjq.org udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 86.49.80.91.in-addr.arpa udp

Files

memory/1696-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/1696-4-0x00000000778F3000-0x00000000778F4000-memory.dmp

memory/1696-3-0x00000000778F2000-0x00000000778F3000-memory.dmp

memory/1696-2-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1696-1-0x00000000778F2000-0x00000000778F3000-memory.dmp

memory/1696-5-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1696-6-0x000000007FE40000-0x000000007FE4C000-memory.dmp

C:\Windows\SysWOW64\lqrjma.exe

MD5 0cae2144249cca11917ce26657fc0281
SHA1 e7ffc36c62c26e987c6954e4739a306a95d119e1
SHA256 5fa749158a4dd5dd030bb97a5ca74a542ae4661b2a76ec69b29d41c3a32e8767
SHA512 50c5ea18407b74fc5d741d602c87a28c0bfebb348a8ff1710026951937b1e9077a353ee0b9bf2eb648b83a60e34a5e934d8b95c1b7e1202933aea875e6975027

memory/1696-10-0x000000007FE30000-0x000000007FE3C000-memory.dmp

memory/1696-12-0x000000007FE30000-0x000000007FE3C000-memory.dmp

memory/1696-11-0x000000007FE30000-0x000000007FE3C000-memory.dmp

memory/1696-13-0x000000007FE30000-0x000000007FE3C000-memory.dmp

memory/1696-16-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/1696-19-0x0000000000400000-0x0000000000431000-memory.dmp

memory/4356-20-0x0000000000400000-0x0000000000431000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\1.html

Signatures

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2836 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3980 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 4772 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3664 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2836 wrote to memory of 3396 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\1.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf63346f8,0x7ffcf6334708,0x7ffcf6334718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,12084559862112096891,15681001241251134513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 21.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

\??\pipe\LOCAL\crashpad_2836_BXBSJBVVHUZOGFYJ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 57d342064ec24044719ccac8c3043607
SHA1 e41eb5e97443577046636bbb7cc3ff8d034e7084
SHA256 e0ff1c0ad2ca6b1d12e60e57b28057dd6a9767dce8a6eac8e931d7a27214f7ed
SHA512 0c71b03fb848575159805ab75937b48abce2c1e83ddfcb69420b0d15d74bbeba00b40bbcc7469c22aed8c9cd81a840ea394cb93a548108990dd9cbd59221ec6e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 a5480962e1cbe4bd1eae5b7d9190a770
SHA1 e39bcceeaf3b06e87aec7bb336f3c9cb2f9f1f50
SHA256 21671ed28a7dd39f8c20f5969d35978fc4ac56813c37e49388d60db9a6181cac
SHA512 7994c3b9be00c22324c93b79aa2a3b42da841d572b2ba8e8bb9e244551bc94ee83711cadfc29a99a7e778de711f8da2d5a2c72c54672c01bb178e6c2dc99c5c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8b19470b033b8210aedd4386bb34fd2a
SHA1 ceec4cbb9d793a26673f4ad6dad43047a751a104
SHA256 7a3bc061a62dc3e3d992ab18f72c22fb21a9527620d55e1bf8d2a10f3e263c34
SHA512 5613cfaae74df93abd544b00a3d73ea6c206930db65ee31e390e5e92adac5e66cdc9759b18db7b00a30e854870b50303f1f7f323e788ceeb45db3d0d7dd5bcbc

Analysis: behavioral6

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240729-en

Max time kernel

134s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\518_2.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\AppPatch\NetSyst76.dll C:\Users\Admin\AppData\Local\Temp\518_2.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\518_2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\518_2.exe

"C:\Users\Admin\AppData\Local\Temp\518_2.exe"

Network

Country Destination Domain Proto
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240708-en

Max time kernel

149s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\711.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\DbProtectSupport\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\DbProtectSupport\fake.cfg C:\Program Files\DbProtectSupport\svchost.exe N/A
File created C:\Program Files\DbProtectSupport\svchost.exe.bak C:\Users\Admin\AppData\Local\Temp\711.exe N/A
File created C:\Program Files\DbProtectSupport\svchost.exe C:\Users\Admin\AppData\Local\Temp\711.exe N/A
File opened for modification C:\Program Files\DbProtectSupport\svchost.exe C:\Users\Admin\AppData\Local\Temp\711.exe N/A
File opened for modification C:\Program Files\DbProtectSupport\fake.cfg C:\Program Files\DbProtectSupport\svchost.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\711.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files\DbProtectSupport\svchost.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\DbProtectSupport\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Program Files\DbProtectSupport\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Program Files\DbProtectSupport\svchost.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\DbProtectSupport\svchost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\711.exe

"C:\Users\Admin\AppData\Local\Temp\711.exe"

C:\Program Files\DbProtectSupport\svchost.exe

"C:\Program Files\DbProtectSupport\svchost.exe"

Network

Country Destination Domain Proto
US 104.243.24.148:10711 tcp
US 104.243.24.148:10711 tcp
US 104.243.24.148:10711 tcp
US 104.243.24.148:10711 tcp
US 104.243.24.148:10711 tcp

Files

C:\Program Files\DbProtectSupport\svchost.exe

MD5 ad2f49936bd8ec7d2c29b1e1e1bef158
SHA1 98a439f9d809724ff0fb212fa30e3723db54bc25
SHA256 0b30fb669ca7be52298c3769467f3c84666b6ebead9b71858ed193eebef5da1a
SHA512 c57db44e7400de825441bf276b2266651fc1eb339dead9746d0c3d45bf12a88a7025cc9628673806e05f171d2f97b5b0909479c64867361649c81d50a04cffe1

Analysis: behavioral29

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240729-en

Max time kernel

118s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe

"C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe"

Network

N/A

Files

memory/2008-0-0x0000000000400000-0x0000000000771000-memory.dmp

memory/2008-1-0x0000000000401000-0x00000000004BA000-memory.dmp

memory/2008-2-0x0000000077F00000-0x0000000077F01000-memory.dmp

memory/2008-10-0x0000000000400000-0x0000000000771000-memory.dmp

memory/2008-8-0x0000000075BA0000-0x0000000075BA1000-memory.dmp

memory/2008-4-0x0000000077F00000-0x0000000077F01000-memory.dmp

memory/2008-12-0x0000000000400000-0x0000000000771000-memory.dmp

memory/2008-13-0x0000000000400000-0x0000000000771000-memory.dmp

memory/2008-14-0x0000000000400000-0x0000000000771000-memory.dmp

Analysis: behavioral31

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:12

Platform

win7-20241010-en

Max time kernel

0s

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\520.exe"

Signatures

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\AppPatch\NetSyst76.dll C:\Users\Admin\AppData\Local\Temp\520.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\520.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\520.exe

"C:\Users\Admin\AppData\Local\Temp\520.exe"

Network

Country Destination Domain Proto
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 22.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 104.149.88.198:8080 tcp
US 104.149.88.198:8080 tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

ubuntu2204-amd64-20240611-en

Max time kernel

149s

Max time network

153s

Command Line

[/tmp/Drkv]

Signatures

MrBlack Trojan

trojan botnet mrblack

MrBlack trojan

Description Indicator Process Target
N/A N/A N/A N/A

Mrblack family

mrblack

File and Directory Permissions Modification

defense_evasion
Description Indicator Process Target
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /usr/bin/chmod N/A
N/A N/A /bin/sh N/A

Executes dropped EXE

Description Indicator Process Target
N/A /usr/bin/bsd-port/getty /usr/bin/bsd-port/getty N/A
N/A /usr/bin/.sshd /usr/bin/.sshd N/A

Modifies init.d

persistence
Description Indicator Process Target
File opened for modification /etc/init.d/DbSecuritySpt /tmp/Drkv N/A
File opened for modification /etc/init.d/selinux /usr/bin/bsd-port/getty N/A

Write file to user bin folder

persistence
Description Indicator Process Target
File opened for modification /usr/bin/bsd-port/getty /usr/bin/cp N/A
File opened for modification /usr/bin/.sshd /usr/bin/cp N/A
File opened for modification /usr/bin/dpkgd/lsof /usr/bin/cp N/A
File opened for modification /usr/bin/bsd-port/getty.lock /tmp/Drkv N/A
File opened for modification /usr/bin/bsd-port/udevd.lock /tmp/Drkv N/A
File opened for modification /usr/bin/bsd-port/getty.lock /usr/bin/bsd-port/getty N/A
File opened for modification /usr/bin/dpkgd/ps /usr/bin/cp N/A
File opened for modification /usr/bin/dpkgd/ss /usr/bin/cp N/A
File opened for modification /usr/bin/lsof /usr/bin/cp N/A
File opened for modification /usr/bin/ps /usr/bin/cp N/A
File opened for modification /usr/bin/ss /usr/bin/cp N/A

Writes file to system bin folder

Description Indicator Process Target
File opened for modification /bin/lsof /usr/bin/cp N/A
File opened for modification /bin/ps /usr/bin/cp N/A
File opened for modification /bin/ss /usr/bin/cp N/A

Checks CPU configuration

antivm
Description Indicator Process Target
File opened for reading /proc/cpuinfo /tmp/Drkv N/A
File opened for reading /proc/cpuinfo /usr/bin/bsd-port/getty N/A

Reads system network configuration

discovery
Description Indicator Process Target
File opened for reading /proc/net/dev /tmp/Drkv N/A
File opened for reading /proc/net/dev /usr/bin/bsd-port/getty N/A

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/sys/kernel/version /usr/bin/.sshd N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/cmdline /usr/sbin/insmod N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/cmdline /usr/sbin/insmod N/A
File opened for reading /proc/sys/kernel/version /tmp/Drkv N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/meminfo /tmp/Drkv N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/meminfo /usr/bin/bsd-port/getty N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/cp N/A
File opened for reading /proc/stat /tmp/Drkv N/A
File opened for reading /proc/sys/kernel/version /usr/bin/bsd-port/getty N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/filesystems /usr/bin/mkdir N/A
File opened for reading /proc/stat /usr/bin/bsd-port/getty N/A

Writes file to tmp directory

Description Indicator Process Target
File opened for modification /tmp/bill.lock /tmp/Drkv N/A
File opened for modification /tmp/gates.lod /tmp/Drkv N/A
File opened for modification /tmp/notify.file /tmp/Drkv N/A
File opened for modification /tmp/moni.lod /usr/bin/.sshd N/A
File opened for modification /tmp/notify.file /usr/bin/.sshd N/A
File opened for modification /tmp/gates.lod /usr/bin/.sshd N/A
File opened for modification /tmp/moni.lod /tmp/Drkv N/A

Processes

/tmp/Drkv

[/tmp/Drkv]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc1.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc2.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc3.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc4.d/S97DbSecuritySpt]

/bin/sh

[sh -c ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt]

/usr/bin/ln

[ln -s /etc/init.d/DbSecuritySpt /etc/rc5.d/S97DbSecuritySpt]

/bin/sh

[sh -c mkdir -p /usr/bin/bsd-port]

/usr/bin/mkdir

[mkdir -p /usr/bin/bsd-port]

/bin/sh

[sh -c mkdir -p /usr/bin/bsd-port]

/usr/bin/mkdir

[mkdir -p /usr/bin/bsd-port]

/bin/sh

[sh -c cp -f /tmp/Drkv /usr/bin/bsd-port/getty]

/usr/bin/cp

[cp -f /tmp/Drkv /usr/bin/bsd-port/getty]

/bin/sh

[sh -c /usr/bin/bsd-port/getty]

/usr/bin/bsd-port/getty

[/usr/bin/bsd-port/getty]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c cp -f /tmp/Drkv /usr/bin/.sshd]

/usr/bin/cp

[cp -f /tmp/Drkv /usr/bin/.sshd]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc1.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc2.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc3.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc4.d/S99selinux]

/bin/sh

[sh -c ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux]

/usr/bin/ln

[ln -s /etc/init.d/selinux /etc/rc5.d/S99selinux]

/bin/sh

[sh -c mkdir -p /usr/bin/dpkgd]

/usr/bin/mkdir

[mkdir -p /usr/bin/dpkgd]

/bin/sh

[sh -c cp -f /bin/lsof /usr/bin/dpkgd/lsof]

/usr/bin/cp

[cp -f /bin/lsof /usr/bin/dpkgd/lsof]

/bin/sh

[sh -c /usr/bin/.sshd]

/usr/bin/.sshd

[/usr/bin/.sshd]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /bin/lsof]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /bin/lsof]

/bin/sh

[sh -c chmod 0755 /bin/lsof]

/usr/bin/chmod

[chmod 0755 /bin/lsof]

/bin/sh

[sh -c cp -f /bin/ps /usr/bin/dpkgd/ps]

/usr/bin/cp

[cp -f /bin/ps /usr/bin/dpkgd/ps]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /bin/ps]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /bin/ps]

/bin/sh

[sh -c chmod 0755 /bin/ps]

/usr/bin/chmod

[chmod 0755 /bin/ps]

/bin/sh

[sh -c cp -f /bin/ss /usr/bin/dpkgd/ss]

/usr/bin/cp

[cp -f /bin/ss /usr/bin/dpkgd/ss]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c mkdir -p /bin]

/usr/bin/mkdir

[mkdir -p /bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /bin/ss]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /bin/ss]

/bin/sh

[sh -c chmod 0755 /bin/ss]

/usr/bin/chmod

[chmod 0755 /bin/ss]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /usr/bin/lsof]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /usr/bin/lsof]

/bin/sh

[sh -c chmod 0755 /usr/bin/lsof]

/usr/bin/chmod

[chmod 0755 /usr/bin/lsof]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /usr/bin/ps]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /usr/bin/ps]

/bin/sh

[sh -c chmod 0755 /usr/bin/ps]

/usr/bin/chmod

[chmod 0755 /usr/bin/ps]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c mkdir -p /usr/bin]

/usr/bin/mkdir

[mkdir -p /usr/bin]

/bin/sh

[sh -c cp -f /usr/bin/bsd-port/getty /usr/bin/ss]

/usr/bin/cp

[cp -f /usr/bin/bsd-port/getty /usr/bin/ss]

/bin/sh

[sh -c chmod 0755 /usr/bin/ss]

/usr/bin/chmod

[chmod 0755 /usr/bin/ss]

/bin/sh

[sh -c insmod /tmp/xpacket.ko]

/usr/sbin/insmod

[insmod /tmp/xpacket.ko]

/bin/sh

[sh -c insmod /usr/bin/bsd-port/xpacket.ko]

/usr/sbin/insmod

[insmod /usr/bin/bsd-port/xpacket.ko]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp
US 8.8.8.8:53 www.t7ux.com udp
US 8.8.8.8:53 top.t7ux.com udp

Files

/tmp/gates.lod

MD5 52947e0ade57a09e4a1386d08f17b656
SHA1 93ee12e112bae593edcf7aecca59464c6afcc832
SHA256 76ced5b53829bb4ca8ab376be09683e92512ef0aab8fb68fcee5121596f94143
SHA512 720ebbf43b5398f25a2c47b16a2383ad16e642989d75c62e83c55bd0c1f529cacaba257beb7616dba44749b6169629dd50fba8bd88ff27cf07f663ec427969f1

/etc/init.d/DbSecuritySpt

MD5 d5173024d4ee3e6d7c12fdeeb023d1cf
SHA1 b2838c393b30adfa1684b169cbdb2a4f60911666
SHA256 15c385186413f367490cdee4b37c6718609e1a865ad75932f3c31af4eea781f8
SHA512 40eae7eaff5388568c0443ea21126ee8f70ce2cb25e2c1c57e2a0a9c8ccfdfb12b2ef904d7026a61bbcb01c85c4d1e0d1bb30ca04ce71c12e909e5358ace3d4d

/usr/bin/bsd-port/getty

MD5 3df5c5e26e2d9fd4946c8121299cd513
SHA1 efaa2e397773a5eda58a68ddce1d9e17a90fdbd3
SHA256 a17ca067bd6f74817a0516e6083c0739fc9b9e36aafd95b74fddc84343972cda
SHA512 9574af57a2984065c6c348f7242533211051c5e9e03c74d6926023c64f61805b4d28698a3c77c3c33ffe33b84f0224f308889a5071bfeca3557fd58043dcca78

/tmp/notify.file

MD5 0c9b8ebc20d7b5f8b47604f2d33c7bcb
SHA1 2f99b8555777ff9ec7c2871a464e530aa0a6d0f6
SHA256 f2ac83a136f4224d06235665b8d6ce11d2ada3e5ba2bc6a04fda9f9faa35f3ec
SHA512 514383bc3eeb327f891425619e29b1ae88e591e349e04ddfb6a6dd15f2531e69cbeeb0e332e54a68337ee4f37ed5314d885655696ba4500f3c91918928017a77

/etc/init.d/selinux

MD5 993cc15058142d96c3daf7852c3d5ee8
SHA1 0950b8b391b04dd3895ea33cd3141543ebd2525d
SHA256 8171d077918611803d93088409f220c66fae1c670b297e1aa5d8cbd548ce9208
SHA512 0c4256c00a3710f97e92581b552682b36b62afc35fe72622c491323c618c19ea62611ac04ccafc3dfcde2254a2ebbd93b69b66795b16e36332293bed83adb928

/usr/bin/dpkgd/lsof

MD5 ab57b66cc531ae0f996963223e632b60
SHA1 bf7e5becd33f21c2539f5a75ffa0ab61c49c8795
SHA256 2484863a7bfda7f97b90bfd5dfceed4ec9f27dd51f9c5158c8daabbf4309b1df
SHA512 908acef13f3c1d80b7169ec3b16bb67006013453348fff75550bc3c6c2137e798b21d7990edbd5be63d756d9c41b06160aebf38aa80547e4bafa3a62596057f6

/usr/bin/dpkgd/ps

MD5 8146139c2ad7e550b1d1f49480997446
SHA1 074db8890c3227bd8a588417f5b9bde637bcf3af
SHA256 207df9d438f75185ab3af2ab1173d104831a6631c28ef40d38b2ab43de27b40f
SHA512 b6d71d537f593b9af833e6f798e412e95fc486a313414ed8cca9639f61be7ac9dca700e9f861c0d07c7f65b3783127a67f829f422472cad8938ba01d397ab9de

/usr/bin/dpkgd/ss

MD5 1b25ac945efae8520ba112b500e2d561
SHA1 8324c4d1d1427829266e82f203386232ff82af15
SHA256 5eb16d9a8bc81fe767725874e3f67623b8e86b46ec93546be49c5b09d3ab4636
SHA512 e191f967170ea4844f736c5ab75b7bf45fef3af34f0a4bef0d36475d646b0b089449fe39806664b9f6ce1984037687930cc368892230662c8c30f67fa3ac216e

/tmp/moni.lod

MD5 a51c896c9cb81ecb5a199d51ac9fc3c5
SHA1 aab7f20827e516402f2387ba6f4f65adb26b54bc
SHA256 1c918023d679a37e1f3338c9029fe54730b3338643dea17773a25e4c67956699
SHA512 d8f82eee8df1267e5c5e776afdf6539e92daad86ea04ab8be38be2c6479bd645c4f18c3849f08c8f24a883b94f22c9280294e6fac4ac14a10e5ab9047eb86b8f

Analysis: behavioral22

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20241010-en

Max time kernel

145s

Max time network

152s

Command Line

wininit.exe

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2724 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\wininit.exe
PID 2724 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\wininit.exe
PID 2724 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\wininit.exe
PID 2724 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\wininit.exe
PID 2724 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\wininit.exe
PID 2724 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\wininit.exe
PID 2724 wrote to memory of 384 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\wininit.exe
PID 2724 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\csrss.exe
PID 2724 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\csrss.exe
PID 2724 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\csrss.exe
PID 2724 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\csrss.exe
PID 2724 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\csrss.exe
PID 2724 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\csrss.exe
PID 2724 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\csrss.exe
PID 2724 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 2724 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 2724 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 2724 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 2724 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 2724 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 2724 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\winlogon.exe
PID 2724 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\services.exe
PID 2724 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\services.exe
PID 2724 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\services.exe
PID 2724 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\services.exe
PID 2724 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\services.exe
PID 2724 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\services.exe
PID 2724 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\services.exe
PID 2724 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 2724 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 2724 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 2724 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 2724 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 2724 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 2724 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsass.exe
PID 2724 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsm.exe
PID 2724 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsm.exe
PID 2724 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsm.exe
PID 2724 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsm.exe
PID 2724 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsm.exe
PID 2724 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsm.exe
PID 2724 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\lsm.exe
PID 2724 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 604 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 680 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\system32\svchost.exe
PID 2724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 2724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 2724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 2724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 2724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 2724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 2724 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe
PID 2724 wrote to memory of 812 N/A C:\Users\Admin\AppData\Local\Temp\HkMh.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

\\?\C:\Windows\system32\wbem\WMIADAP.EXE

wmiadap.exe /F /T /R

C:\Users\Admin\AppData\Local\Temp\HkMh.exe

"C:\Users\Admin\AppData\Local\Temp\HkMh.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp
N/A 127.0.0.1:8888 tcp
N/A 127.0.0.1:8888 tcp
US 8.8.8.8:53 zebing520.vicp.cc udp
CN 47.111.82.157:8888 zebing520.vicp.cc tcp

Files

memory/2724-0-0x0000000000400000-0x000000000042C000-memory.dmp

\Users\Admin\AppData\Local\Temp\xxlEDE8.tmp

MD5 685f1cbd4af30a1d0c25f252d399a666
SHA1 6a1b978f5e6150b88c8634146f1406ed97d2f134
SHA256 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA512 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

memory/2724-4-0x0000000000220000-0x0000000000293000-memory.dmp

memory/2724-6-0x0000000077640000-0x0000000077641000-memory.dmp

memory/2724-5-0x000000007763F000-0x0000000077640000-memory.dmp

memory/2724-7-0x0000000010000000-0x0000000010024000-memory.dmp

memory/2724-11-0x0000000000400000-0x000000000042C000-memory.dmp

memory/2724-12-0x0000000000220000-0x0000000000293000-memory.dmp

memory/2724-21-0x0000000000220000-0x0000000000293000-memory.dmp

Analysis: behavioral25

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

winlogon.exe

Signatures

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HkMh_2.exe:*:enabled:@shell32.dll,-1" C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cntvs_Me_Please = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HkMh_2.exe" C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2672 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 2672 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 2672 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 2672 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 2672 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 2672 wrote to memory of 616 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\winlogon.exe
PID 2672 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 2672 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 2672 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 2672 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 2672 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 2672 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\lsass.exe
PID 2672 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\fontdrvhost.exe
PID 2672 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 804 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 912 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 964 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\dwm.exe
PID 2672 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\dwm.exe
PID 2672 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\dwm.exe
PID 2672 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\dwm.exe
PID 2672 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\dwm.exe
PID 2672 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\dwm.exe
PID 2672 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 408 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 2672 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 2672 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 2672 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 2672 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 2672 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\System32\svchost.exe
PID 2672 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe
PID 2672 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe C:\Windows\system32\svchost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\fontdrvhost.exe

"fontdrvhost.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe

"C:\Users\Admin\AppData\Local\Temp\HkMh_2.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.mddos.com udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 ilo.brenz.pl udp
US 3.18.7.81:1380 www.mddos.com tcp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 3.18.7.81:1380 www.mddos.com tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 www.mddos.com udp
US 54.209.32.212:1380 www.mddos.com tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 iptcan.com udp
US 8.8.8.8:53 tycrzq.com udp
US 8.8.8.8:53 rzitsh.com udp
US 8.8.8.8:53 qelylj.com udp
US 8.8.8.8:53 fiwals.com udp
US 8.8.8.8:53 ihgwmf.com udp
US 8.8.8.8:53 xeatuu.com udp
US 8.8.8.8:53 wgahti.com udp
US 8.8.8.8:53 nawuqi.com udp
US 8.8.8.8:53 dwbgah.com udp
US 8.8.8.8:53 uamieo.com udp
US 8.8.8.8:53 nbakvc.com udp
US 8.8.8.8:53 muodmz.com udp
US 8.8.8.8:53 oyhpsw.com udp
US 8.8.8.8:53 okwlod.com udp
US 8.8.8.8:53 hiuazw.com udp
US 8.8.8.8:53 yoouia.com udp
US 8.8.8.8:53 vmusya.com udp
US 8.8.8.8:53 huaqaa.com udp
US 8.8.8.8:53 wakyeu.com udp
US 8.8.8.8:53 qixwod.com udp
US 8.8.8.8:53 mxjdei.com udp
US 8.8.8.8:53 ezkmos.com udp
US 8.8.8.8:53 koqmwl.com udp
US 8.8.8.8:53 hfoitg.com udp
US 8.8.8.8:53 ifcivp.com udp
US 8.8.8.8:53 xzteau.com udp
US 8.8.8.8:53 osfegh.com udp
US 8.8.8.8:53 ecties.com udp
US 8.8.8.8:53 jmdskh.com udp
US 8.8.8.8:53 saiaip.com udp
US 8.8.8.8:53 nbiynk.com udp
US 8.8.8.8:53 esvfpn.com udp
US 8.8.8.8:53 aomknu.com udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 jkusro.com udp
US 8.8.8.8:53 ujyofa.com udp
US 8.8.8.8:53 viwgta.com udp
US 8.8.8.8:53 aochha.com udp
US 8.8.8.8:53 alitfw.com udp
US 8.8.8.8:53 fqsvnp.com udp
US 8.8.8.8:53 onoimf.com udp
US 8.8.8.8:53 uoirzd.com udp
US 8.8.8.8:53 elvmih.com udp
US 8.8.8.8:53 jhaser.com udp
US 8.8.8.8:53 aguiic.com udp
US 8.8.8.8:53 kulbax.com udp
US 8.8.8.8:53 ayaoya.com udp
NL 37.97.254.27:443 ayaoya.com tcp
US 8.8.8.8:53 27.254.97.37.in-addr.arpa udp
US 54.209.32.212:1380 www.mddos.com tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 sktoat.com udp
US 8.8.8.8:53 zeoztj.com udp
US 8.8.8.8:53 imljmm.com udp
US 8.8.8.8:53 udexos.com udp
US 8.8.8.8:53 mhpgge.com udp
US 8.8.8.8:53 oeltpz.com udp
US 8.8.8.8:53 cnrtso.com udp
US 8.8.8.8:53 taxnrn.com udp
US 8.8.8.8:53 pvqyuu.com udp
US 8.8.8.8:53 eeuibt.com udp
US 8.8.8.8:53 bewmji.com udp
US 8.8.8.8:53 gcquya.com udp
US 8.8.8.8:53 nusaqa.com udp
US 8.8.8.8:53 mpwbef.com udp
US 8.8.8.8:53 gdyknk.com udp
US 8.8.8.8:53 ejnoct.com udp
US 8.8.8.8:53 rrekie.com udp
US 8.8.8.8:53 ealrfu.com udp
US 8.8.8.8:53 pkujec.com udp
US 8.8.8.8:53 wuetai.com udp
US 8.8.8.8:53 slqaeu.com udp
US 8.8.8.8:53 zoebid.com udp
US 8.8.8.8:53 hkcjaj.com udp
US 8.8.8.8:53 goelza.com udp
US 8.8.8.8:53 ietzrj.com udp
US 8.8.8.8:53 egvyuz.com udp
US 8.8.8.8:53 ueoeyz.com udp
US 8.8.8.8:53 umqeim.com udp
US 8.8.8.8:53 ajjmmj.com udp
US 8.8.8.8:53 fqdonf.com udp
US 8.8.8.8:53 zgkrep.com udp
US 8.8.8.8:53 opceza.com udp
US 8.8.8.8:53 xrqvfr.com udp
US 8.8.8.8:53 eazqep.com udp
US 8.8.8.8:53 eoeswy.com udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 uwyzjm.com udp
US 8.8.8.8:53 saeyjo.com udp
US 8.8.8.8:53 nkywsx.com udp
US 8.8.8.8:53 uyiyrz.com udp
US 8.8.8.8:53 srmuoy.com udp
US 8.8.8.8:53 poxeda.com udp
US 8.8.8.8:53 iqlaeo.com udp
US 8.8.8.8:53 ajfqgv.com udp
US 8.8.8.8:53 anucfa.com udp
US 8.8.8.8:53 opharj.com udp
US 8.8.8.8:53 kwfzlj.com udp
US 8.8.8.8:53 eofhxu.com udp
US 8.8.8.8:53 rxkhfo.com udp
US 8.8.8.8:53 imuxei.com udp
US 8.8.8.8:53 yucdmu.com udp
US 8.8.8.8:53 upcsvi.com udp
US 8.8.8.8:53 dmadyx.com udp
US 54.209.32.212:1380 www.mddos.com tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 ilo.brenz.pl udp
US 8.8.8.8:53 ant.trenz.pl udp
DE 88.198.69.43:80 tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 www.mddos.com udp
US 3.94.41.167:1380 www.mddos.com tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 www.mddos.com udp
US 52.86.6.113:1380 www.mddos.com tcp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 mhddos.lyjq.org udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/2672-0-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\rli6FB2.tmp

MD5 685f1cbd4af30a1d0c25f252d399a666
SHA1 6a1b978f5e6150b88c8634146f1406ed97d2f134
SHA256 0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA512 6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

memory/2672-5-0x00000000005C0000-0x0000000000633000-memory.dmp

memory/2672-10-0x00000000778B3000-0x00000000778B4000-memory.dmp

memory/2672-9-0x00000000778B2000-0x00000000778B3000-memory.dmp

memory/2672-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/2672-11-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/2672-12-0x000000007FE40000-0x000000007FE4C000-memory.dmp

memory/2672-13-0x00000000005C0000-0x0000000000633000-memory.dmp

memory/2672-15-0x00000000005C0000-0x0000000000633000-memory.dmp

memory/2672-20-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2672-22-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Analysis: behavioral26

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240903-en

Max time kernel

150s

Max time network

128s

Command Line

wininit.exe

Signatures

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\rifzsk.exe C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
File opened for modification C:\Windows\SysWOW64\rifzsk.exe C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rifzsk.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A
N/A N/A C:\Windows\SysWOW64\rifzsk.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\rifzsk.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2092 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\wininit.exe
PID 2092 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\wininit.exe
PID 2092 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\wininit.exe
PID 2092 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\wininit.exe
PID 2092 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\wininit.exe
PID 2092 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\wininit.exe
PID 2092 wrote to memory of 380 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\wininit.exe
PID 2092 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\csrss.exe
PID 2092 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\csrss.exe
PID 2092 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\csrss.exe
PID 2092 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\csrss.exe
PID 2092 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\csrss.exe
PID 2092 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\csrss.exe
PID 2092 wrote to memory of 396 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\csrss.exe
PID 2092 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 2092 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 2092 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 2092 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 2092 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 2092 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 2092 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\winlogon.exe
PID 2092 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\services.exe
PID 2092 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\services.exe
PID 2092 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\services.exe
PID 2092 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\services.exe
PID 2092 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\services.exe
PID 2092 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\services.exe
PID 2092 wrote to memory of 480 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\services.exe
PID 2092 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 2092 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 2092 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 2092 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 2092 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 2092 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 2092 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsass.exe
PID 2092 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsm.exe
PID 2092 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsm.exe
PID 2092 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsm.exe
PID 2092 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsm.exe
PID 2092 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsm.exe
PID 2092 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsm.exe
PID 2092 wrote to memory of 496 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\lsm.exe
PID 2092 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 600 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\system32\svchost.exe
PID 2092 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 2092 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 2092 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 2092 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 2092 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 2092 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 2092 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe
PID 2092 wrote to memory of 824 N/A C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe C:\Windows\System32\svchost.exe

Processes

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe

"C:\Users\Admin\AppData\Local\Temp\HkMh_3.exe"

C:\Windows\SysWOW64\rifzsk.exe

C:\Windows\SysWOW64\rifzsk.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 mhyk.lyjq.org udp

Files

memory/2092-0-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2092-3-0x00000000771A0000-0x00000000771A1000-memory.dmp

memory/2092-2-0x000000007719F000-0x00000000771A0000-memory.dmp

C:\Windows\SysWOW64\rifzsk.exe

MD5 0cae2144249cca11917ce26657fc0281
SHA1 e7ffc36c62c26e987c6954e4739a306a95d119e1
SHA256 5fa749158a4dd5dd030bb97a5ca74a542ae4661b2a76ec69b29d41c3a32e8767
SHA512 50c5ea18407b74fc5d741d602c87a28c0bfebb348a8ff1710026951937b1e9077a353ee0b9bf2eb648b83a60e34a5e934d8b95c1b7e1202933aea875e6975027

memory/2092-8-0x0000000000400000-0x0000000000431000-memory.dmp

memory/2092-7-0x000000007EF90000-0x000000007EF9C000-memory.dmp

memory/2092-6-0x000000007719F000-0x00000000771A0000-memory.dmp

memory/2092-5-0x00000000771A0000-0x00000000771A1000-memory.dmp

memory/1640-9-0x0000000000400000-0x0000000000431000-memory.dmp

Analysis: behavioral28

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

ubuntu2404-amd64-20240523-en

Max time kernel

0s

Max time network

132s

Command Line

[/tmp/Killbash.x]

Signatures

Reads runtime system information

discovery
Description Indicator Process Target
File opened for reading /proc/self/maps /usr/bin/awk N/A
File opened for reading /proc/self/maps /usr/bin/awk N/A
File opened for reading /proc/filesystems /usr/bin/sed N/A

Processes

/tmp/Killbash.x

[/tmp/Killbash.x]

/bin/sh

[/tmp/Killbash.x -c exec '/tmp/Killbash.x' "$@" /tmp/Killbash.x]

/tmp/Killbash.x

[/tmp/Killbash.x]

/bin/sh

[/tmp/Killbash.x -c #!/bin/sh Config="/etc/init.d/Me8ing.conf" tempfile=`cat $Config | awk '{print $1}'` filetemp="/usr/bin/$tempfile" filename=`date +%s%N | md5sum | head -c 10` filepath="/usr/bin/$filename" tempbash=`cat $Config | awk '{print $2}'` bashtemp="/usr/bin/$tempbash" bashname=`date +%s%N | md5sum | head -c 10` bashpath="/usr/bin/$bashname" lockr -i $bashtemp;rm -f $bashtemp;killall $tempbash;pkill $tempbash lockr -i $filetemp;rm -f $filetemp;killall $tempfile;pkill $tempfile lockr -i /etc/rc.local;sed -i "s|$bashtemp start||" /etc/rc.local rm -f $0 exit /tmp/Killbash.x]

/usr/bin/cat

[cat /etc/init.d/Me8ing.conf]

/usr/bin/awk

[awk {print $1}]

/usr/bin/date

[date +%s%N]

/usr/bin/md5sum

[md5sum]

/usr/bin/head

[head -c 10]

/usr/bin/cat

[cat /etc/init.d/Me8ing.conf]

/usr/bin/awk

[awk {print $2}]

/usr/bin/date

[date +%s%N]

/usr/bin/md5sum

[md5sum]

/usr/bin/head

[head -c 10]

/usr/bin/rm

[rm -f /usr/bin/]

/usr/bin/killall

[killall]

/usr/bin/pkill

[pkill]

/usr/bin/rm

[rm -f /usr/bin/]

/usr/bin/killall

[killall]

/usr/bin/pkill

[pkill]

/usr/bin/sed

[sed -i s|/usr/bin/ start|| /etc/rc.local]

/usr/bin/rm

[rm -f /tmp/Killbash.x]

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp

Files

memory/2825-1-0x0000000000400000-0x00000000006b0a58-memory.dmp

memory/2825-2-0x0000000000400000-0x00000000006b0a58-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20241010-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe"

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe

"C:\Users\Admin\AppData\Local\Temp\客户端(Client)_KEY.exe"

Network

N/A

Files

memory/1304-0-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1304-1-0x0000000077930000-0x0000000077932000-memory.dmp

memory/1304-11-0x0000000004260000-0x0000000004261000-memory.dmp

memory/1304-15-0x0000000004330000-0x0000000004331000-memory.dmp

memory/1304-14-0x00000000042A0000-0x00000000042A1000-memory.dmp

memory/1304-13-0x0000000004300000-0x0000000004301000-memory.dmp

memory/1304-16-0x0000000000401000-0x0000000000461000-memory.dmp

memory/1304-12-0x0000000004240000-0x0000000004241000-memory.dmp

memory/1304-10-0x0000000004220000-0x0000000004221000-memory.dmp

memory/1304-9-0x0000000004280000-0x0000000004281000-memory.dmp

memory/1304-8-0x0000000004350000-0x0000000004351000-memory.dmp

memory/1304-7-0x0000000004250000-0x0000000004252000-memory.dmp

memory/1304-6-0x00000000042D0000-0x00000000042D1000-memory.dmp

memory/1304-5-0x0000000004230000-0x0000000004231000-memory.dmp

memory/1304-4-0x00000000042F0000-0x00000000042F2000-memory.dmp

memory/1304-3-0x0000000004290000-0x0000000004291000-memory.dmp

memory/1304-2-0x00000000042B0000-0x00000000042B1000-memory.dmp

memory/1304-17-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1304-18-0x0000000000400000-0x00000000006DF000-memory.dmp

memory/1304-21-0x0000000000400000-0x00000000006DF000-memory.dmp

Analysis: behavioral10

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240903-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\10711.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\10711.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\10711.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10711.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\10711.exe

"C:\Users\Admin\AppData\Local\Temp\10711.exe"

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win7-20240903-en

Max time kernel

117s

Max time network

123s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2096 wrote to memory of 2548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2096 wrote to memory of 2548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2096 wrote to memory of 2548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2096 wrote to memory of 2548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2096 wrote to memory of 2548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2096 wrote to memory of 2548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2096 wrote to memory of 2548 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\FCK_RSC.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-12-08 01:12

Reported

2024-12-08 01:15

Platform

win10v2004-20241007-en

Max time kernel

93s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe"

Signatures

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe

"C:\Users\Admin\AppData\Local\Temp\服务器(Server)\服务器(Server).exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1028-0-0x0000000000400000-0x0000000000771000-memory.dmp

memory/1028-1-0x0000000000401000-0x00000000004BA000-memory.dmp

memory/1028-2-0x0000000000400000-0x0000000000771000-memory.dmp

memory/1028-4-0x0000000000400000-0x0000000000771000-memory.dmp

memory/1028-5-0x0000000000400000-0x0000000000771000-memory.dmp

memory/1028-6-0x00000000027D0000-0x00000000027E9000-memory.dmp

memory/1028-7-0x0000000000400000-0x0000000000771000-memory.dmp