sality | 3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe:*:enabled:@shell32.dll,-1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe:*:Enabled:ipsec"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win32SystemFile = "C:\\MSystem.exe"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2436272344-4274332273-444425594-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftPCHealth = "C:\\Windows\\System32\\PCHealth.exe"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Application Installer = "C:\\Windows\\Installer\\Installer.exe"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\O:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\R:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\X:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\G:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\L:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\M:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\Q:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\T:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\Y:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\Z:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\I:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\N:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\P:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\U:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\H:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\J:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\S:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\V:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\W:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened (read-only)	\??\E:	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	F:\autorun.inf	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PCHealth.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\Windows\SysWOW64\PCHealth.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4548-8-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-12-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-15-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-17-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-16-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-14-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-38-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-13-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-10-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-11-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-41-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-42-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-43-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-44-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-45-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-47-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-48-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-49-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-50-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-57-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-58-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-60-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-63-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-66-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-68-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-70-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-72-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-74-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-76-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-78-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-81-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-82-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-84-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-86-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-100-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-103-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-104-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-106-0x0000000002F80000-0x000000000400E000-memory.dmp	upx
behavioral2/memory/4548-114-0x0000000002F80000-0x000000000400E000-memory.dmp	upx

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7ZFM.EXE	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7Z.EXE	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7ZG.EXE	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\Installer.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File opened for modification	C:\Windows\SYSTEM.INI	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
File created	C:\Windows\Installer\Installer.exe	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
Token: SeDebugPrivilege	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 620	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	5
PID 4548 wrote to memory of 620	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	5
PID 4548 wrote to memory of 620	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	5
PID 4548 wrote to memory of 620	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	5
PID 4548 wrote to memory of 620	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	5
PID 4548 wrote to memory of 620	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	5
PID 4548 wrote to memory of 676	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	7
PID 4548 wrote to memory of 676	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	7
PID 4548 wrote to memory of 676	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	7
PID 4548 wrote to memory of 676	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	7
PID 4548 wrote to memory of 676	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	7
PID 4548 wrote to memory of 676	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	7
PID 4548 wrote to memory of 772	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	8
PID 4548 wrote to memory of 772	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	8
PID 4548 wrote to memory of 772	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	8
PID 4548 wrote to memory of 772	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	8
PID 4548 wrote to memory of 772	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	8
PID 4548 wrote to memory of 772	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	8
PID 4548 wrote to memory of 784	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	9
PID 4548 wrote to memory of 784	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	9
PID 4548 wrote to memory of 784	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	9
PID 4548 wrote to memory of 784	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	9
PID 4548 wrote to memory of 784	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	9
PID 4548 wrote to memory of 784	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	9
PID 4548 wrote to memory of 788	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	10
PID 4548 wrote to memory of 788	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	10
PID 4548 wrote to memory of 788	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	10
PID 4548 wrote to memory of 788	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	10
PID 4548 wrote to memory of 788	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	10
PID 4548 wrote to memory of 788	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	10
PID 4548 wrote to memory of 896	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	11
PID 4548 wrote to memory of 896	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	11
PID 4548 wrote to memory of 896	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	11
PID 4548 wrote to memory of 896	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	11
PID 4548 wrote to memory of 896	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	11
PID 4548 wrote to memory of 896	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	11
PID 4548 wrote to memory of 952	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	12
PID 4548 wrote to memory of 952	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	12
PID 4548 wrote to memory of 952	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	12
PID 4548 wrote to memory of 952	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	12
PID 4548 wrote to memory of 952	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	12
PID 4548 wrote to memory of 952	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	12
PID 4548 wrote to memory of 64	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	13
PID 4548 wrote to memory of 64	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	13
PID 4548 wrote to memory of 64	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	13
PID 4548 wrote to memory of 64	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	13
PID 4548 wrote to memory of 64	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	13
PID 4548 wrote to memory of 64	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	13
PID 4548 wrote to memory of 736	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	14
PID 4548 wrote to memory of 736	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	14
PID 4548 wrote to memory of 736	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	14
PID 4548 wrote to memory of 736	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	14
PID 4548 wrote to memory of 736	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	14
PID 4548 wrote to memory of 736	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	14
PID 4548 wrote to memory of 948	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	15
PID 4548 wrote to memory of 948	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	15
PID 4548 wrote to memory of 948	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	15
PID 4548 wrote to memory of 948	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	15
PID 4548 wrote to memory of 948	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	15
PID 4548 wrote to memory of 948	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	15
PID 4548 wrote to memory of 512	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	16
PID 4548 wrote to memory of 512	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	16
PID 4548 wrote to memory of 512	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	16
PID 4548 wrote to memory of 512	4548	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe	16

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:788
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:772
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:2912
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3768
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3856
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3920
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:4016
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4200
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:2300
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:5004
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3736
- C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
  2⤵
  PID:5044
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:4520
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:4060
- C:\Windows\system32\BackgroundTaskHost.exe
  "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
  2⤵
  PID:2208
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3528
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:4600

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1136
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2972
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:3428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2064

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2268

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2704

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3352

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Users\Admin\AppData\Local\Temp\3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe
  "C:\Users\Admin\AppData\Local\Temp\3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1404

Network

DNS

ilo.brenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ilo.brenz.pl

IN A

Response
DNS

8.8.8.8.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

66.160.190.20.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

66.160.190.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

ant.trenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ant.trenz.pl

IN A

Response
DNS

212.20.149.52.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

212.20.149.52.in-addr.arpa

IN PTR

Response
DNS

241.42.69.40.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

241.42.69.40.in-addr.arpa

IN PTR

Response
DNS

166.190.18.2.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

166.190.18.2.in-addr.arpa

IN PTR

Response

166.190.18.2.in-addr.arpa

IN PTR

a2-18-190-166deploystaticakamaitechnologiescom
DNS

ilo.brenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ilo.brenz.pl

IN A

Response
DNS

ant.trenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ant.trenz.pl

IN A

Response
DNS

hywawu.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

hywawu.com

IN A

Response
DNS

yeyeeu.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

yeyeeu.com

IN A

Response
DNS

kxynyq.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kxynyq.com

IN A

Response
DNS

hmmsbh.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

hmmsbh.com

IN A

Response
DNS

xuatju.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xuatju.com

IN A

Response
DNS

auuqac.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

auuqac.com

IN A

Response
DNS

qcbtek.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

qcbtek.com

IN A

Response
DNS

umkfvh.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

umkfvh.com

IN A

Response
DNS

lneiaw.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

lneiaw.com

IN A

Response
DNS

sytaus.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

sytaus.com

IN A

Response
DNS

ozyapy.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ozyapy.com

IN A

Response
DNS

nzfhke.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

nzfhke.com

IN A

Response
DNS

zoqzeo.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

zoqzeo.com

IN A

Response
DNS

qumbxt.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

qumbxt.com

IN A

Response
DNS

wjetqm.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wjetqm.com

IN A

Response
DNS

eqhimm.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

eqhimm.com

IN A

Response
DNS

zszcyc.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

zszcyc.com

IN A

Response
DNS

aoueva.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

aoueva.com

IN A

Response
DNS

ydrjyc.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ydrjyc.com

IN A

Response
DNS

rbcoqi.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

rbcoqi.com

IN A

Response
DNS

uwzjxk.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

uwzjxk.com

IN A

Response
DNS

swnsmh.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

swnsmh.com

IN A

Response
DNS

kxwdsf.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kxwdsf.com

IN A

Response
DNS

foghvz.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

foghvz.com

IN A

Response
DNS

mbdtuv.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

mbdtuv.com

IN A

Response
DNS

bseyif.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

bseyif.com

IN A

Response
DNS

riluqe.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

riluqe.com

IN A

Response
DNS

noulty.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

noulty.com

IN A

Response
DNS

uyaaoo.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

uyaaoo.com

IN A

Response
DNS

xozuxd.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xozuxd.com

IN A

Response
DNS

oqvteb.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

oqvteb.com

IN A

Response
DNS

lugkyn.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

lugkyn.com

IN A

Response
DNS

lugkyn.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

lugkyn.com

IN A

Response
DNS

vrboce.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vrboce.com

IN A

Response
DNS

vrboce.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vrboce.com

IN A

Response
DNS

lohzgw.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

lohzgw.com

IN A

Response
DNS

lohzgw.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

lohzgw.com

IN A

Response
DNS

liyael.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

liyael.com

IN A

Response
DNS

liyael.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

liyael.com

IN A

Response
DNS

vcyyyz.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vcyyyz.com

IN A

Response
DNS

vcyyyz.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vcyyyz.com

IN A

Response
DNS

yviljz.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

yviljz.com

IN A

Response
DNS

yviljz.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

yviljz.com

IN A

Response
DNS

osmiti.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

osmiti.com

IN A

Response
DNS

fuonpf.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

fuonpf.com

IN A

Response
DNS

mykdim.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

mykdim.com

IN A

Response
DNS

mykdim.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

mykdim.com

IN A

Response
DNS

aiuxah.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

aiuxah.com

IN A

Response
DNS

aiuxah.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

aiuxah.com

IN A

Response
DNS

zqiqiy.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

zqiqiy.com

IN A

Response
DNS

zqiqiy.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

zqiqiy.com

IN A

Response
DNS

kouvir.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kouvir.com

IN A

Response
DNS

kouvir.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kouvir.com

IN A

Response
DNS

epshrd.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

epshrd.com

IN A

Response
DNS

epshrd.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

epshrd.com

IN A

Response
DNS

useyui.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

useyui.com

IN A

Response
DNS

useyui.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

useyui.com

IN A

Response
DNS

zmbhtg.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

zmbhtg.com

IN A

Response
DNS

zmbhtg.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

zmbhtg.com

IN A

Response
DNS

rpeksm.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

rpeksm.com

IN A

Response
DNS

rpeksm.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

rpeksm.com

IN A

Response
DNS

sobmkp.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

sobmkp.com

IN A

Response
DNS

loucya.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

loucya.com

IN A

Response
DNS

loucya.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

loucya.com

IN A

Response
DNS

abyxpy.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

abyxpy.com

IN A

Response
DNS

abyxpy.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

abyxpy.com

IN A

Response
DNS

lyjnee.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

lyjnee.com

IN A

Response
DNS

lyjnee.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

lyjnee.com

IN A

Response
DNS

xyzecu.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xyzecu.com

IN A

Response
DNS

xyzecu.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xyzecu.com

IN A

Response
DNS

ooyosg.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ooyosg.com

IN A

Response
DNS

ooyosg.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ooyosg.com

IN A

Response
DNS

eaefpd.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

eaefpd.com

IN A

Response
DNS

eaefpd.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

eaefpd.com

IN A

Response
DNS

vlvbdi.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vlvbdi.com

IN A

Response
DNS

vlvbdi.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vlvbdi.com

IN A

Response
DNS

kwvrai.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kwvrai.com

IN A

Response
DNS

kwvrai.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kwvrai.com

IN A

Response
DNS

wvgqyg.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wvgqyg.com

IN A

Response
DNS

wvgqyg.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wvgqyg.com

IN A

Response
DNS

iesavo.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

iesavo.com

IN A

Response
DNS

iesavo.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

iesavo.com

IN A

Response
DNS

xaovma.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xaovma.com

IN A

Response
DNS

xaovma.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xaovma.com

IN A

Response
DNS

udbxqh.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

udbxqh.com

IN A

Response
DNS

udbxqh.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

udbxqh.com

IN A

Response
DNS

cwilre.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

cwilre.com

IN A

Response
DNS

cwilre.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

cwilre.com

IN A

Response
DNS

iucoit.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

iucoit.com

IN A

Response
DNS

iucoit.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

iucoit.com

IN A

Response
DNS

bohhyj.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

bohhyj.com

IN A

Response
DNS

bohhyj.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

bohhyj.com

IN A

Response
DNS

yutwyp.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

yutwyp.com

IN A

Response
DNS

yutwyp.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

yutwyp.com

IN A

Response
DNS

cpfquv.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

cpfquv.com

IN A

Response
DNS

cpfquv.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

cpfquv.com

IN A

Response
DNS

aeboym.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

aeboym.com

IN A

Response
DNS

avbwkp.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

avbwkp.com

IN A

Response
DNS

avbwkp.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

avbwkp.com

IN A

Response
DNS

qsridp.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

qsridp.com

IN A

Response
DNS

qsridp.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

qsridp.com

IN A

Response
DNS

kcuama.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kcuama.com

IN A

Response
DNS

kcuama.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kcuama.com

IN A

Response
DNS

xeften.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xeften.com

IN A

Response
DNS

xeften.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xeften.com

IN A

Response
DNS

wpenwv.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wpenwv.com

IN A

Response
DNS

wpenwv.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wpenwv.com

IN A

Response
DNS

wveayx.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wveayx.com

IN A

Response
DNS

wveayx.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wveayx.com

IN A

Response
DNS

smlsyb.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

smlsyb.com

IN A

Response
DNS

smlsyb.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

smlsyb.com

IN A

Response
DNS

ukkmjt.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ukkmjt.com

IN A

Response
DNS

ukkmjt.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ukkmjt.com

IN A

Response
DNS

eclqjt.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

eclqjt.com

IN A

Response
DNS

eclqjt.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

eclqjt.com

IN A

Response
DNS

xfuosu.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xfuosu.com

IN A

Response
DNS

xfuosu.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xfuosu.com

IN A

Response
DNS

wvetol.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wvetol.com

IN A

Response
DNS

wvetol.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wvetol.com

IN A

Response
DNS

byqiyk.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

byqiyk.com

IN A

Response
DNS

byqiyk.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

byqiyk.com

IN A

Response
DNS

ihjnkq.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ihjnkq.com

IN A

Response
DNS

ihjnkq.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ihjnkq.com

IN A

Response
DNS

deiswn.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

deiswn.com

IN A

Response
DNS

deiswn.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

deiswn.com

IN A

Response
DNS

umaosy.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

umaosy.com

IN A

Response
DNS

umaosy.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

umaosy.com

IN A

Response
DNS

iurksw.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

iurksw.com

IN A

Response
DNS

iurksw.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

iurksw.com

IN A

Response
DNS

ltrmel.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ltrmel.com

IN A

Response
DNS

ltrmel.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ltrmel.com

IN A

Response
DNS

kkxiue.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kkxiue.com

IN A

Response
DNS

kkxiue.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

kkxiue.com

IN A

Response
DNS

xdszae.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xdszae.com

IN A

Response
DNS

xdszae.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xdszae.com

IN A

Response
DNS

wvyznc.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wvyznc.com

IN A

Response
DNS

wvyznc.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

wvyznc.com

IN A

Response
DNS

xjothl.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xjothl.com

IN A

Response
DNS

xjothl.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xjothl.com

IN A

Response
DNS

evgxxr.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

evgxxr.com

IN A

Response
DNS

evgxxr.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

evgxxr.com

IN A

Response
DNS

tkzvmf.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

tkzvmf.com

IN A

Response
DNS

tkzvmf.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

tkzvmf.com

IN A

Response
DNS

xnuatz.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xnuatz.com

IN A

Response
DNS

xnuatz.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

xnuatz.com

IN A

Response
DNS

vnhqir.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vnhqir.com

IN A

Response
DNS

vnhqir.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

vnhqir.com

IN A

Response
DNS

ibsidb.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ibsidb.com

IN A

Response
DNS

ibsidb.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ibsidb.com

IN A

Response
DNS

krahaa.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

krahaa.com

IN A

Response
DNS

krahaa.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

krahaa.com

IN A

Response
DNS

svbjue.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

svbjue.com

IN A

Response
DNS

svbjue.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

svbjue.com

IN A

Response
DNS

otamun.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

otamun.com

IN A

Response
DNS

otamun.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

otamun.com

IN A

Response
DNS

ocafsa.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ocafsa.com

IN A

Response
DNS

ocafsa.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ocafsa.com

IN A

Response
DNS

ntvmik.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ntvmik.com

IN A

Response
DNS

ntvmik.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ntvmik.com

IN A

Response
DNS

ghznoa.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ghznoa.com

IN A

Response
DNS

ghznoa.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ghznoa.com

IN A

Response
DNS

hutuge.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

hutuge.com

IN A

Response

hutuge.com

IN CNAME

ab.cloudflare.182682.xyz

ab.cloudflare.182682.xyz

IN A

104.19.48.236

ab.cloudflare.182682.xyz

IN A

104.16.155.10

ab.cloudflare.182682.xyz

IN A

198.41.209.70

ab.cloudflare.182682.xyz

IN A

104.17.213.241

ab.cloudflare.182682.xyz

IN A

104.17.221.248
DNS

hutuge.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

hutuge.com

IN A

Response

hutuge.com

IN CNAME

ab.cloudflare.182682.xyz

ab.cloudflare.182682.xyz

IN A

104.17.213.241

ab.cloudflare.182682.xyz

IN A

104.17.221.248

ab.cloudflare.182682.xyz

IN A

104.19.48.236

ab.cloudflare.182682.xyz

IN A

104.16.155.10

ab.cloudflare.182682.xyz

IN A

198.41.209.70
DNS

236.48.19.104.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

236.48.19.104.in-addr.arpa

IN PTR

Response
DNS

236.48.19.104.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

236.48.19.104.in-addr.arpa

IN PTR

Response
DNS

uqejdt.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

uqejdt.com

IN A

Response
DNS

172.214.232.199.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

29.243.111.52.in-addr.arpa

Dnscache

Remote address:

8.8.8.8:53

Request

29.243.111.52.in-addr.arpa

IN PTR

Response
DNS

ilo.brenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ilo.brenz.pl

IN A

Response
DNS

ilo.brenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ilo.brenz.pl

IN A

Response
DNS

ant.trenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ant.trenz.pl

IN A

Response
DNS

ant.trenz.pl

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

Remote address:

8.8.8.8:53

Request

ant.trenz.pl

IN A

Response

114.112.255.81:80

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

260 B
5
114.112.255.81:80

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

260 B
5
104.19.48.236:443

hutuge.com

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

190 B
132 B
4
3
114.112.255.81:80

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

208 B
4

8.8.8.8:53

ilo.brenz.pl

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

58 B
58 B
1
1

DNS Request

ilo.brenz.pl
8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

Dnscache

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

66.160.190.20.in-addr.arpa

dns

Dnscache

72 B
158 B
1
1

DNS Request

66.160.190.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

Dnscache

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

ant.trenz.pl

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

58 B
58 B
1
1

DNS Request

ant.trenz.pl
8.8.8.8:53

212.20.149.52.in-addr.arpa

dns

Dnscache

72 B
146 B
1
1

DNS Request

212.20.149.52.in-addr.arpa
8.8.8.8:53

241.42.69.40.in-addr.arpa

dns

Dnscache

71 B
145 B
1
1

DNS Request

241.42.69.40.in-addr.arpa
8.8.8.8:53

166.190.18.2.in-addr.arpa

dns

Dnscache

71 B
135 B
1
1

DNS Request

166.190.18.2.in-addr.arpa
8.8.8.8:53

ilo.brenz.pl

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

58 B
58 B
1
1

DNS Request

ilo.brenz.pl
8.8.8.8:53

ant.trenz.pl

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

58 B
58 B
1
1

DNS Request

ant.trenz.pl
8.8.8.8:53

hywawu.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

hywawu.com
8.8.8.8:53

yeyeeu.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

yeyeeu.com
8.8.8.8:53

kxynyq.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

kxynyq.com
8.8.8.8:53

hmmsbh.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

hmmsbh.com
8.8.8.8:53

xuatju.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

xuatju.com
8.8.8.8:53

auuqac.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

auuqac.com
8.8.8.8:53

qcbtek.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

qcbtek.com
8.8.8.8:53

umkfvh.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

umkfvh.com
8.8.8.8:53

lneiaw.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

lneiaw.com
8.8.8.8:53

sytaus.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

sytaus.com
8.8.8.8:53

ozyapy.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

ozyapy.com
8.8.8.8:53

nzfhke.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

nzfhke.com
8.8.8.8:53

zoqzeo.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

zoqzeo.com
8.8.8.8:53

qumbxt.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

qumbxt.com
8.8.8.8:53

wjetqm.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

wjetqm.com
8.8.8.8:53

eqhimm.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

eqhimm.com
8.8.8.8:53

zszcyc.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

zszcyc.com
8.8.8.8:53

aoueva.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

aoueva.com
8.8.8.8:53

ydrjyc.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

ydrjyc.com
8.8.8.8:53

rbcoqi.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

rbcoqi.com
8.8.8.8:53

uwzjxk.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

uwzjxk.com
8.8.8.8:53

swnsmh.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

swnsmh.com
8.8.8.8:53

kxwdsf.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

kxwdsf.com
8.8.8.8:53

foghvz.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

foghvz.com
8.8.8.8:53

mbdtuv.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

mbdtuv.com
8.8.8.8:53

bseyif.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

bseyif.com
8.8.8.8:53

riluqe.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

riluqe.com
8.8.8.8:53

noulty.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

noulty.com
8.8.8.8:53

uyaaoo.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

uyaaoo.com
8.8.8.8:53

xozuxd.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

xozuxd.com
8.8.8.8:53

oqvteb.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

oqvteb.com
8.8.8.8:53

lugkyn.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

lugkyn.com

DNS Request

lugkyn.com
8.8.8.8:53

vrboce.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

vrboce.com

DNS Request

vrboce.com
8.8.8.8:53

lohzgw.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

lohzgw.com

DNS Request

lohzgw.com
8.8.8.8:53

liyael.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

liyael.com

DNS Request

liyael.com
8.8.8.8:53

vcyyyz.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

vcyyyz.com

DNS Request

vcyyyz.com
8.8.8.8:53

yviljz.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

yviljz.com

DNS Request

yviljz.com
8.8.8.8:53

osmiti.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

osmiti.com
8.8.8.8:53

fuonpf.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

fuonpf.com
8.8.8.8:53

mykdim.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

mykdim.com

DNS Request

mykdim.com
8.8.8.8:53

aiuxah.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

aiuxah.com

DNS Request

aiuxah.com
8.8.8.8:53

zqiqiy.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

zqiqiy.com

DNS Request

zqiqiy.com
8.8.8.8:53

kouvir.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

kouvir.com

DNS Request

kouvir.com
8.8.8.8:53

epshrd.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

epshrd.com

DNS Request

epshrd.com
8.8.8.8:53

useyui.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

useyui.com

DNS Request

useyui.com
8.8.8.8:53

zmbhtg.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

zmbhtg.com

DNS Request

zmbhtg.com
8.8.8.8:53

rpeksm.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

rpeksm.com

DNS Request

rpeksm.com
8.8.8.8:53

sobmkp.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

sobmkp.com
8.8.8.8:53

loucya.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

loucya.com

DNS Request

loucya.com
8.8.8.8:53

abyxpy.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

abyxpy.com

DNS Request

abyxpy.com
8.8.8.8:53

lyjnee.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

lyjnee.com

DNS Request

lyjnee.com
8.8.8.8:53

xyzecu.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

xyzecu.com

DNS Request

xyzecu.com
8.8.8.8:53

ooyosg.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ooyosg.com

DNS Request

ooyosg.com
8.8.8.8:53

eaefpd.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

eaefpd.com

DNS Request

eaefpd.com
8.8.8.8:53

vlvbdi.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

vlvbdi.com

DNS Request

vlvbdi.com
8.8.8.8:53

kwvrai.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

kwvrai.com

DNS Request

kwvrai.com
8.8.8.8:53

wvgqyg.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

wvgqyg.com

DNS Request

wvgqyg.com
8.8.8.8:53

iesavo.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

iesavo.com

DNS Request

iesavo.com
8.8.8.8:53

xaovma.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

xaovma.com

DNS Request

xaovma.com
8.8.8.8:53

udbxqh.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

udbxqh.com

DNS Request

udbxqh.com
8.8.8.8:53

cwilre.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

cwilre.com

DNS Request

cwilre.com
8.8.8.8:53

iucoit.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

iucoit.com

DNS Request

iucoit.com
8.8.8.8:53

bohhyj.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

bohhyj.com

DNS Request

bohhyj.com
8.8.8.8:53

yutwyp.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

yutwyp.com

DNS Request

yutwyp.com
8.8.8.8:53

cpfquv.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

cpfquv.com

DNS Request

cpfquv.com
8.8.8.8:53

aeboym.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

aeboym.com
8.8.8.8:53

avbwkp.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

avbwkp.com

DNS Request

avbwkp.com
8.8.8.8:53

qsridp.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

qsridp.com

DNS Request

qsridp.com
8.8.8.8:53

kcuama.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

kcuama.com

DNS Request

kcuama.com
8.8.8.8:53

xeften.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

xeften.com

DNS Request

xeften.com
8.8.8.8:53

wpenwv.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

wpenwv.com

DNS Request

wpenwv.com
8.8.8.8:53

wveayx.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

wveayx.com

DNS Request

wveayx.com
8.8.8.8:53

smlsyb.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

smlsyb.com

DNS Request

smlsyb.com
8.8.8.8:53

ukkmjt.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ukkmjt.com

DNS Request

ukkmjt.com
8.8.8.8:53

eclqjt.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

eclqjt.com

DNS Request

eclqjt.com
8.8.8.8:53

xfuosu.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

xfuosu.com

DNS Request

xfuosu.com
8.8.8.8:53

wvetol.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

wvetol.com

DNS Request

wvetol.com
8.8.8.8:53

byqiyk.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

byqiyk.com

DNS Request

byqiyk.com
8.8.8.8:53

ihjnkq.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ihjnkq.com

DNS Request

ihjnkq.com
8.8.8.8:53

deiswn.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

deiswn.com

DNS Request

deiswn.com
8.8.8.8:53

umaosy.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

umaosy.com

DNS Request

umaosy.com
8.8.8.8:53

iurksw.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

iurksw.com

DNS Request

iurksw.com
8.8.8.8:53

ltrmel.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ltrmel.com

DNS Request

ltrmel.com
8.8.8.8:53

kkxiue.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

kkxiue.com

DNS Request

kkxiue.com
8.8.8.8:53

xdszae.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

xdszae.com

DNS Request

xdszae.com
8.8.8.8:53

wvyznc.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

wvyznc.com

DNS Request

wvyznc.com
8.8.8.8:53

xjothl.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

xjothl.com

DNS Request

xjothl.com
8.8.8.8:53

evgxxr.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

evgxxr.com

DNS Request

evgxxr.com
8.8.8.8:53

tkzvmf.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

tkzvmf.com

DNS Request

tkzvmf.com
8.8.8.8:53

xnuatz.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

xnuatz.com

DNS Request

xnuatz.com
8.8.8.8:53

vnhqir.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

vnhqir.com

DNS Request

vnhqir.com
8.8.8.8:53

ibsidb.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ibsidb.com

DNS Request

ibsidb.com
8.8.8.8:53

krahaa.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

krahaa.com

DNS Request

krahaa.com
8.8.8.8:53

svbjue.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

svbjue.com

DNS Request

svbjue.com
8.8.8.8:53

otamun.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

otamun.com

DNS Request

otamun.com
8.8.8.8:53

ocafsa.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ocafsa.com

DNS Request

ocafsa.com
8.8.8.8:53

ntvmik.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ntvmik.com

DNS Request

ntvmik.com
8.8.8.8:53

ghznoa.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
258 B
2
2

DNS Request

ghznoa.com

DNS Request

ghznoa.com
8.8.8.8:53

hutuge.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

112 B
348 B
2
2

DNS Request

hutuge.com

DNS Request

hutuge.com

DNS Response

104.19.48.236

104.16.155.10

198.41.209.70

104.17.213.241

104.17.221.248

DNS Response

104.17.213.241

104.17.221.248

104.19.48.236

104.16.155.10

198.41.209.70
8.8.8.8:53

236.48.19.104.in-addr.arpa

dns

Dnscache

144 B
268 B
2
2

DNS Request

236.48.19.104.in-addr.arpa

DNS Request

236.48.19.104.in-addr.arpa
8.8.8.8:53

uqejdt.com

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

56 B
129 B
1
1

DNS Request

uqejdt.com
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

Dnscache

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

29.243.111.52.in-addr.arpa

dns

Dnscache

72 B
158 B
1
1

DNS Request

29.243.111.52.in-addr.arpa
8.8.8.8:53

ilo.brenz.pl

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

116 B
116 B
2
2

DNS Request

ilo.brenz.pl

DNS Request

ilo.brenz.pl
8.8.8.8:53

ant.trenz.pl

dns

3703bb46bea3b386482287c1d6b3c79ff4fe201ff843a804946d97f0e82b6fdf.exe

116 B
116 B
2
2

DNS Request

ant.trenz.pl

DNS Request

ant.trenz.pl

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry