Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
86s -
max time network
208s -
platform
windows11_x64 -
resource
win11 -
submitted
13-08-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
8 (3).exe
Resource
win11
Behavioral task
behavioral2
Sample
8 (30).exe
Resource
win11
Behavioral task
behavioral3
Sample
8 (31).exe
Resource
win11
Errors
General
-
Target
8 (3).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2164-515-0x00000000015B0000-0x0000000001ED6000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5348 4788 rUNdlL32.eXe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exe family_redline C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exe family_redline behavioral1/memory/4440-341-0x0000000007120000-0x0000000007152000-memory.dmp family_redline behavioral1/memory/3932-407-0x0000000000000000-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 11 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 4604 created 572 4604 WerFault.exe setup_install.exe PID 5244 created 4924 5244 WerFault.exe sonia_3.exe PID 5288 created 3116 5288 WerFault.exe sonia_2.exe PID 5404 created 5368 5404 WerFault.exe rundll32.exe PID 5984 created 5752 5984 WerFault.exe T8xDAZMgqa3KJVG0JU7sPHTh.exe PID 5232 created 6104 5232 WerFault.exe 1S1NA2Zmby7lsGyRexfuLYjt.exe PID 5312 created 1780 5312 WerFault.exe powershell.exe PID 1080 created 2164 1080 WerFault.exe HIlirLkDZaRA_zLJsSxMganh.exe PID 6020 created 5400 6020 WerFault.exe 3568807.exe PID 5968 created 5384 5968 WerFault.exe 8698367.exe PID 5564 created 948 5564 WerFault.exe 4659369.exe -
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5632-345-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft -
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4924-204-0x0000000000B90000-0x0000000000C2D000-memory.dmp family_vidar behavioral1/memory/5752-243-0x0000000004880000-0x000000000491D000-memory.dmp family_vidar behavioral1/memory/1780-406-0x00000000049A0000-0x0000000004A3D000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurlpp.dll aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exesonia_3.exesonia_1.exesonia_2.exesonia_6.exesonia_4.exesonia_5.exesonia_1.exejfiag3g_gg.exe9euI9Lu3UBMqFnhjQtXIU_y0.exe58wjr4PU89QYrNHU_4CgnrYq.exeT8xDAZMgqa3KJVG0JU7sPHTh.exe_f2sJ5S2ZhEnlM42EeHXplIV.exe4UdLc_mFcwqveMWoPB9bFRnK.exex7FTjuwTomibB8p06AVC8eBD.exebDqRzXdCTpLzYyoSz_dPvBT8.exe1S1NA2Zmby7lsGyRexfuLYjt.exex7FTjuwTomibB8p06AVC8eBD.exeoarWi7uU2p8LHM4_EpbluQY3.exejfiag3g_gg.exelpWtbKjTpenAEX7sBF1KmRKX.exe3568807.exe8114088.exe8698367.exelpWtbKjTpenAEX7sBF1KmRKX.tmp4519590.exe6944905.exe4659369.exe11111.exe1y4i0Jd1zp8RtYtRq5IpF02m.exeWinHoster.exeSetup.exe11111.exe22222.exe22222.exepowershell.exeZl14TiIC4mbFtvvG3BKhBfTz.exePXGFEvetfo20YxRHZwiGOgov.exeHIlirLkDZaRA_zLJsSxMganh.exe2ueQSyqopXXNYf8KFCG65Gh4.exe58wjr4PU89QYrNHU_4CgnrYq.execustomer3.exeGameBox.exemd8_8eus.exeGameBox32Bit.exejooyu.exeBotCheck.exe11111.exe11111.exeWerFault.exejfiag3g_gg.exe11111.exe6792303.exejfiag3g_gg.exe1750317.exe11111.exe11111.exe11111.exe11111.exeWerFault.exejfiag3g_gg.exejfiag3g_gg.exepid process 4952 setup_installer.exe 572 setup_install.exe 4924 sonia_3.exe 4904 sonia_1.exe 3116 sonia_2.exe 772 sonia_6.exe 4736 sonia_4.exe 3824 sonia_5.exe 3472 sonia_1.exe 5192 jfiag3g_gg.exe 5728 9euI9Lu3UBMqFnhjQtXIU_y0.exe 5740 58wjr4PU89QYrNHU_4CgnrYq.exe 5752 T8xDAZMgqa3KJVG0JU7sPHTh.exe 5764 _f2sJ5S2ZhEnlM42EeHXplIV.exe 5776 4UdLc_mFcwqveMWoPB9bFRnK.exe 5788 x7FTjuwTomibB8p06AVC8eBD.exe 5812 bDqRzXdCTpLzYyoSz_dPvBT8.exe 6104 1S1NA2Zmby7lsGyRexfuLYjt.exe 6048 x7FTjuwTomibB8p06AVC8eBD.exe 6128 oarWi7uU2p8LHM4_EpbluQY3.exe 5244 jfiag3g_gg.exe 4444 lpWtbKjTpenAEX7sBF1KmRKX.exe 5400 3568807.exe 5504 8114088.exe 5384 8698367.exe 5396 lpWtbKjTpenAEX7sBF1KmRKX.tmp 3620 4519590.exe 4440 6944905.exe 948 4659369.exe 5632 11111.exe 5296 1y4i0Jd1zp8RtYtRq5IpF02m.exe 5560 WinHoster.exe 704 Setup.exe 1124 11111.exe 1168 22222.exe 708 22222.exe 1780 powershell.exe 5600 Zl14TiIC4mbFtvvG3BKhBfTz.exe 1892 PXGFEvetfo20YxRHZwiGOgov.exe 2164 HIlirLkDZaRA_zLJsSxMganh.exe 5268 2ueQSyqopXXNYf8KFCG65Gh4.exe 3932 58wjr4PU89QYrNHU_4CgnrYq.exe 6124 customer3.exe 3492 GameBox.exe 2960 md8_8eus.exe 5236 GameBox32Bit.exe 3276 jooyu.exe 5472 BotCheck.exe 1452 11111.exe 5320 11111.exe 4460 WerFault.exe 4452 jfiag3g_gg.exe 5424 11111.exe 5624 6792303.exe 5568 jfiag3g_gg.exe 4568 1750317.exe 5308 11111.exe 6024 11111.exe 5068 11111.exe 4056 11111.exe 5564 WerFault.exe 1452 11111.exe 1888 jfiag3g_gg.exe 3064 jfiag3g_gg.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
PXGFEvetfo20YxRHZwiGOgov.exe4UdLc_mFcwqveMWoPB9bFRnK.exeZl14TiIC4mbFtvvG3BKhBfTz.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PXGFEvetfo20YxRHZwiGOgov.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PXGFEvetfo20YxRHZwiGOgov.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4UdLc_mFcwqveMWoPB9bFRnK.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4UdLc_mFcwqveMWoPB9bFRnK.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Zl14TiIC4mbFtvvG3BKhBfTz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Zl14TiIC4mbFtvvG3BKhBfTz.exe -
Loads dropped DLL 10 IoCs
Processes:
setup_install.exerundll32.exelpWtbKjTpenAEX7sBF1KmRKX.tmp1y4i0Jd1zp8RtYtRq5IpF02m.exepid process 572 setup_install.exe 572 setup_install.exe 572 setup_install.exe 572 setup_install.exe 572 setup_install.exe 5368 rundll32.exe 5396 lpWtbKjTpenAEX7sBF1KmRKX.tmp 5396 lpWtbKjTpenAEX7sBF1KmRKX.tmp 5296 1y4i0Jd1zp8RtYtRq5IpF02m.exe 5296 1y4i0Jd1zp8RtYtRq5IpF02m.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exe themida C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exe themida behavioral1/memory/5776-272-0x00000000007C0000-0x00000000007C1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
sonia_6.exe8114088.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 8114088.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
4UdLc_mFcwqveMWoPB9bFRnK.exeZl14TiIC4mbFtvvG3BKhBfTz.exePXGFEvetfo20YxRHZwiGOgov.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4UdLc_mFcwqveMWoPB9bFRnK.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Zl14TiIC4mbFtvvG3BKhBfTz.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PXGFEvetfo20YxRHZwiGOgov.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 api.db-ip.com 69 ipinfo.io 2 ipinfo.io 2 ip-api.com 2 api.db-ip.com 13 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
4UdLc_mFcwqveMWoPB9bFRnK.exeZl14TiIC4mbFtvvG3BKhBfTz.exePXGFEvetfo20YxRHZwiGOgov.exepid process 5776 4UdLc_mFcwqveMWoPB9bFRnK.exe 5600 Zl14TiIC4mbFtvvG3BKhBfTz.exe 1892 PXGFEvetfo20YxRHZwiGOgov.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
x7FTjuwTomibB8p06AVC8eBD.exe58wjr4PU89QYrNHU_4CgnrYq.exedescription pid process target process PID 5788 set thread context of 6048 5788 x7FTjuwTomibB8p06AVC8eBD.exe x7FTjuwTomibB8p06AVC8eBD.exe PID 5740 set thread context of 3932 5740 58wjr4PU89QYrNHU_4CgnrYq.exe 58wjr4PU89QYrNHU_4CgnrYq.exe -
Drops file in Program Files directory 64 IoCs
Processes:
1y4i0Jd1zp8RtYtRq5IpF02m.exeSetup.exedescription ioc process File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dirac_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libafile_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libexport_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\speaker-32.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemux_cdg_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsmf_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libhotkeys_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvobsub_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\buttons.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\reader\filename.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\cli.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_equalizer.html 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libvcd_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdiracsys_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libpva_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\liblogo_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\data_load.exe 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\host.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\cue.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_flac_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\browse.json 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_imem_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libdemuxdump_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libgestures_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawdv_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_window.html 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.xml 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libntservice_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvoc_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\video_splitter\libclone_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\luac.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\dkjson.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\connection.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\custom.lua 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_dummy_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\logger\libconsole_logger_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm.html 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\misc\libaddonsvorepository_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_copy_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dts_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libgme_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\mux\libmux_asf_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mpegvideo_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\lua\liblua_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\d3d11\libdirect3d11_filters_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsubtitle_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_vc1_plugin.dll 1y4i0Jd1zp8RtYtRq5IpF02m.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\main.css 1y4i0Jd1zp8RtYtRq5IpF02m.exe -
Drops file in Windows directory 1 IoCs
Processes:
WerFault.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 14 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2964 572 WerFault.exe setup_install.exe 5264 4924 WerFault.exe sonia_3.exe 5308 3116 WerFault.exe sonia_2.exe 5428 5368 WerFault.exe rundll32.exe 3896 5752 WerFault.exe T8xDAZMgqa3KJVG0JU7sPHTh.exe 5008 6104 WerFault.exe 1S1NA2Zmby7lsGyRexfuLYjt.exe 2948 1780 WerFault.exe gqDXzn0ASbKRe8FTudT66X2X.exe 4460 2164 WerFault.exe HIlirLkDZaRA_zLJsSxMganh.exe 5816 5400 WerFault.exe 3568807.exe 5184 5384 WerFault.exe 8698367.exe 5004 948 WerFault.exe 4659369.exe 5460 5624 WerFault.exe 6792303.exe 2856 3388 WerFault.exe 3B55.exe 2816 5144 WerFault.exe 4096.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
x7FTjuwTomibB8p06AVC8eBD.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI x7FTjuwTomibB8p06AVC8eBD.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI x7FTjuwTomibB8p06AVC8eBD.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI x7FTjuwTomibB8p06AVC8eBD.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeMoNotificationUx.exeWerFault.exeWerFault.exeMoNotificationUx.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MoNotificationUx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MoNotificationUx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MoNotificationUx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Enumerates system info in registry 2 TTPs 22 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
sihclient.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe -
Modifies registry class 6 IoCs
Processes:
MiniSearchHost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 68 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 70 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exex7FTjuwTomibB8p06AVC8eBD.exejfiag3g_gg.exeWerFault.exeWerFault.exepid process 2964 WerFault.exe 2964 WerFault.exe 5264 WerFault.exe 5264 WerFault.exe 5308 WerFault.exe 5308 WerFault.exe 5428 WerFault.exe 5428 WerFault.exe 6048 x7FTjuwTomibB8p06AVC8eBD.exe 6048 x7FTjuwTomibB8p06AVC8eBD.exe 5244 jfiag3g_gg.exe 5244 jfiag3g_gg.exe 5008 WerFault.exe 5008 WerFault.exe 3896 WerFault.exe 3896 WerFault.exe 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3100 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
x7FTjuwTomibB8p06AVC8eBD.exepid process 6048 x7FTjuwTomibB8p06AVC8eBD.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exesonia_4.exeWerFault.exebDqRzXdCTpLzYyoSz_dPvBT8.exeoarWi7uU2p8LHM4_EpbluQY3.exe3568807.exe4UdLc_mFcwqveMWoPB9bFRnK.exe4659369.exe8698367.exe6944905.exe58wjr4PU89QYrNHU_4CgnrYq.exe4519590.exe2ueQSyqopXXNYf8KFCG65Gh4.exe58wjr4PU89QYrNHU_4CgnrYq.exeZl14TiIC4mbFtvvG3BKhBfTz.exePXGFEvetfo20YxRHZwiGOgov.exe6792303.exedescription pid process Token: SeSystemEnvironmentPrivilege 4512 svchost.exe Token: SeDebugPrivilege 4736 sonia_4.exe Token: SeRestorePrivilege 2964 WerFault.exe Token: SeBackupPrivilege 2964 WerFault.exe Token: SeBackupPrivilege 2964 WerFault.exe Token: SeDebugPrivilege 5812 bDqRzXdCTpLzYyoSz_dPvBT8.exe Token: SeDebugPrivilege 6128 oarWi7uU2p8LHM4_EpbluQY3.exe Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeDebugPrivilege 5400 3568807.exe Token: SeDebugPrivilege 5776 4UdLc_mFcwqveMWoPB9bFRnK.exe Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeDebugPrivilege 948 4659369.exe Token: SeDebugPrivilege 5384 8698367.exe Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeDebugPrivilege 4440 6944905.exe Token: SeDebugPrivilege 5740 58wjr4PU89QYrNHU_4CgnrYq.exe Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeDebugPrivilege 3620 4519590.exe Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeDebugPrivilege 5268 2ueQSyqopXXNYf8KFCG65Gh4.exe Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeDebugPrivilege 3932 58wjr4PU89QYrNHU_4CgnrYq.exe Token: SeShutdownPrivilege 3100 Token: SeCreatePagefilePrivilege 3100 Token: SeDebugPrivilege 5600 Zl14TiIC4mbFtvvG3BKhBfTz.exe Token: SeDebugPrivilege 1892 PXGFEvetfo20YxRHZwiGOgov.exe Token: SeDebugPrivilege 5624 6792303.exe Token: SeShutdownPrivilege 3100 -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
lpWtbKjTpenAEX7sBF1KmRKX.tmppid process 5396 lpWtbKjTpenAEX7sBF1KmRKX.tmp 3100 3100 3100 3100 3100 -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
pid process 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 3100 -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
MiniSearchHost.exepid process 3100 3100 3100 3100 3100 2208 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8 (3).exesetup_installer.exesvchost.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exeWerFault.exesonia_1.exesonia_6.exeWerFault.exeWerFault.exerUNdlL32.eXeWerFault.exesonia_5.exedescription pid process target process PID 4548 wrote to memory of 4952 4548 8 (3).exe setup_installer.exe PID 4548 wrote to memory of 4952 4548 8 (3).exe setup_installer.exe PID 4548 wrote to memory of 4952 4548 8 (3).exe setup_installer.exe PID 4952 wrote to memory of 572 4952 setup_installer.exe setup_install.exe PID 4952 wrote to memory of 572 4952 setup_installer.exe setup_install.exe PID 4952 wrote to memory of 572 4952 setup_installer.exe setup_install.exe PID 5048 wrote to memory of 4344 5048 svchost.exe pcaui.exe PID 5048 wrote to memory of 4344 5048 svchost.exe pcaui.exe PID 572 wrote to memory of 4452 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4452 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4452 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4464 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4464 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4464 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4444 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4444 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4444 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4796 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4796 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4796 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4656 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4656 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4656 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4112 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4112 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4112 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4984 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4984 572 setup_install.exe cmd.exe PID 572 wrote to memory of 4984 572 setup_install.exe cmd.exe PID 4444 wrote to memory of 4924 4444 cmd.exe sonia_3.exe PID 4444 wrote to memory of 4924 4444 cmd.exe sonia_3.exe PID 4444 wrote to memory of 4924 4444 cmd.exe sonia_3.exe PID 4452 wrote to memory of 4904 4452 cmd.exe sonia_1.exe PID 4452 wrote to memory of 4904 4452 cmd.exe sonia_1.exe PID 4452 wrote to memory of 4904 4452 cmd.exe sonia_1.exe PID 4464 wrote to memory of 3116 4464 cmd.exe sonia_2.exe PID 4464 wrote to memory of 3116 4464 cmd.exe sonia_2.exe PID 4464 wrote to memory of 3116 4464 cmd.exe sonia_2.exe PID 4112 wrote to memory of 772 4112 cmd.exe sonia_6.exe PID 4112 wrote to memory of 772 4112 cmd.exe sonia_6.exe PID 4112 wrote to memory of 772 4112 cmd.exe sonia_6.exe PID 4796 wrote to memory of 4736 4796 cmd.exe sonia_4.exe PID 4796 wrote to memory of 4736 4796 cmd.exe sonia_4.exe PID 4656 wrote to memory of 3824 4656 cmd.exe sonia_5.exe PID 4656 wrote to memory of 3824 4656 cmd.exe sonia_5.exe PID 4656 wrote to memory of 3824 4656 cmd.exe sonia_5.exe PID 4604 wrote to memory of 572 4604 WerFault.exe setup_install.exe PID 4604 wrote to memory of 572 4604 WerFault.exe setup_install.exe PID 4904 wrote to memory of 3472 4904 sonia_1.exe sonia_1.exe PID 4904 wrote to memory of 3472 4904 sonia_1.exe sonia_1.exe PID 4904 wrote to memory of 3472 4904 sonia_1.exe sonia_1.exe PID 772 wrote to memory of 5192 772 sonia_6.exe jfiag3g_gg.exe PID 772 wrote to memory of 5192 772 sonia_6.exe jfiag3g_gg.exe PID 772 wrote to memory of 5192 772 sonia_6.exe jfiag3g_gg.exe PID 5244 wrote to memory of 4924 5244 WerFault.exe sonia_3.exe PID 5244 wrote to memory of 4924 5244 WerFault.exe sonia_3.exe PID 5288 wrote to memory of 3116 5288 WerFault.exe sonia_2.exe PID 5288 wrote to memory of 3116 5288 WerFault.exe sonia_2.exe PID 5348 wrote to memory of 5368 5348 rUNdlL32.eXe rundll32.exe PID 5348 wrote to memory of 5368 5348 rUNdlL32.eXe rundll32.exe PID 5348 wrote to memory of 5368 5348 rUNdlL32.eXe rundll32.exe PID 5404 wrote to memory of 5368 5404 WerFault.exe rundll32.exe PID 5404 wrote to memory of 5368 5404 WerFault.exe rundll32.exe PID 3824 wrote to memory of 5728 3824 sonia_5.exe 9euI9Lu3UBMqFnhjQtXIU_y0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8 (3).exe"C:\Users\Admin\AppData\Local\Temp\8 (3).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 2446⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\_f2sJ5S2ZhEnlM42EeHXplIV.exe"C:\Users\Admin\Documents\_f2sJ5S2ZhEnlM42EeHXplIV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\T8xDAZMgqa3KJVG0JU7sPHTh.exe"C:\Users\Admin\Documents\T8xDAZMgqa3KJVG0JU7sPHTh.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5752 -s 2767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exe"C:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exeC:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exe7⤵
-
C:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exeC:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\9euI9Lu3UBMqFnhjQtXIU_y0.exe"C:\Users\Admin\Documents\9euI9Lu3UBMqFnhjQtXIU_y0.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\bDqRzXdCTpLzYyoSz_dPvBT8.exe"C:\Users\Admin\Documents\bDqRzXdCTpLzYyoSz_dPvBT8.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\3568807.exe"C:\Users\Admin\AppData\Roaming\3568807.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5400 -s 23928⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\8114088.exe"C:\Users\Admin\AppData\Roaming\8114088.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4519590.exe"C:\Users\Admin\AppData\Roaming\4519590.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\4659369.exe"C:\Users\Admin\AppData\Roaming\4659369.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 25568⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\x7FTjuwTomibB8p06AVC8eBD.exe"C:\Users\Admin\Documents\x7FTjuwTomibB8p06AVC8eBD.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\x7FTjuwTomibB8p06AVC8eBD.exe"C:\Users\Admin\Documents\x7FTjuwTomibB8p06AVC8eBD.exe"7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exe"C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\1S1NA2Zmby7lsGyRexfuLYjt.exe"C:\Users\Admin\Documents\1S1NA2Zmby7lsGyRexfuLYjt.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 2767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\oarWi7uU2p8LHM4_EpbluQY3.exe"C:\Users\Admin\Documents\oarWi7uU2p8LHM4_EpbluQY3.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8698367.exe"C:\Users\Admin\AppData\Roaming\8698367.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5384 -s 24008⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\6944905.exe"C:\Users\Admin\AppData\Roaming\6944905.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\lpWtbKjTpenAEX7sBF1KmRKX.exe"C:\Users\Admin\Documents\lpWtbKjTpenAEX7sBF1KmRKX.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-9UC12.tmp\lpWtbKjTpenAEX7sBF1KmRKX.tmp"C:\Users\Admin\AppData\Local\Temp\is-9UC12.tmp\lpWtbKjTpenAEX7sBF1KmRKX.tmp" /SL5="$601F6,138429,56832,C:\Users\Admin\Documents\lpWtbKjTpenAEX7sBF1KmRKX.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-P13D5.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-P13D5.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"9⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\note8876.exe"C:\Users\Admin\AppData\Local\Temp\note8876.exe" end10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"10⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\1y4i0Jd1zp8RtYtRq5IpF02m.exe"C:\Users\Admin\Documents\1y4i0Jd1zp8RtYtRq5IpF02m.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsu5F4E.tmp\tempfile.ps1"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsu5F4E.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsu5F4E.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsu5F4E.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsu5F4E.tmp\tempfile.ps1"7⤵
-
C:\Users\Admin\Documents\8eRZDfO1sE_ncMOXd4643jpW.exe"C:\Users\Admin\Documents\8eRZDfO1sE_ncMOXd4643jpW.exe"6⤵
-
C:\Users\Admin\Documents\PXGFEvetfo20YxRHZwiGOgov.exe"C:\Users\Admin\Documents\PXGFEvetfo20YxRHZwiGOgov.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Zl14TiIC4mbFtvvG3BKhBfTz.exe"C:\Users\Admin\Documents\Zl14TiIC4mbFtvvG3BKhBfTz.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\gqDXzn0ASbKRe8FTudT66X2X.exe"C:\Users\Admin\Documents\gqDXzn0ASbKRe8FTudT66X2X.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 2767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\ibxINZMiQpR5I32xCvPxH15J.exe"C:\Users\Admin\Documents\ibxINZMiQpR5I32xCvPxH15J.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\2ueQSyqopXXNYf8KFCG65Gh4.exe"C:\Users\Admin\Documents\2ueQSyqopXXNYf8KFCG65Gh4.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6792303.exe"C:\Users\Admin\AppData\Roaming\6792303.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5624 -s 22608⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\1750317.exe"C:\Users\Admin\AppData\Roaming\1750317.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\HIlirLkDZaRA_zLJsSxMganh.exe"C:\Users\Admin\Documents\HIlirLkDZaRA_zLJsSxMganh.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 2407⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 4964⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\pcaui.exeC:\Windows\System32\pcaui.exe -n 0 -a "" -v "" -g "" -x ""2⤵
-
C:\Windows\system32\MoNotificationUx.exe%systemroot%\system32\MoNotificationUx.exe /ClearActiveNotifications1⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_3.exesonia_3.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 2442⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 572 -ip 5721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4924 -ip 49241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3116 -ip 31161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 4563⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5368 -ip 53681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\MoNotificationUx.exe%systemroot%\system32\MoNotificationUx.exe /ClearActiveNotifications1⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5752 -ip 57521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv R3q930x020WnyfI9gsy3Ow.0.21⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6104 -ip 61041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1780 -ip 17801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2164 -ip 21641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 492 -p 5400 -ip 54001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 568 -p 5384 -ip 53841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 948 -ip 9481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 5624 -ip 56241⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\372E.exeC:\Users\Admin\AppData\Local\Temp\372E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\3B55.exeC:\Users\Admin\AppData\Local\Temp\3B55.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 2762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3388 -ip 33881⤵
-
C:\Users\Admin\AppData\Local\Temp\4096.exeC:\Users\Admin\AppData\Local\Temp\4096.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 2362⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4385.exeC:\Users\Admin\AppData\Local\Temp\4385.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5144 -ip 51441⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a2d055 /state1:0x41c64e6d1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_1.txtMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_2.exeMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_2.txtMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_3.exeMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_3.txtMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_4.exeMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_4.txtMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_5.exeMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_5.txtMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_6.exeMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\7zS853F72A3\sonia_6.txtMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
99ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
a174d42aebd9b07b023f7508e05c279b
SHA1f70cd24ba0b5b801a04111a9c5b5ec324926c7c3
SHA256fef48e8c21cc4c8f7ebf5580d2488df5793dba5589c7e042934ea1a0b4c9beb2
SHA5124897e43aedf30651a450ed3e978c35e76e51d9f001ddf9353d62a8f375cb2f5caf203603dc463a9bf6f1f866b0943acd00734a222fce17721705d7e3329825ef
-
C:\Users\Admin\AppData\Local\Temp\is-9UC12.tmp\lpWtbKjTpenAEX7sBF1KmRKX.tmpMD5
ffcf263a020aa7794015af0edee5df0b
SHA1bce1eb5f0efb2c83f416b1782ea07c776666fdab
SHA2561d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64
SHA51249f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Roaming\3568807.exeMD5
fabab477a6e10cea86bc448c20e0d522
SHA124a1d01b18930308aa7ffd85f32c32171f5d3355
SHA2566dabfe3090b7dd3b0742c0db345e7eac9046c5e25ebc7246d94e7853d63f3518
SHA5128d7413b256ce16289535401fd6a7c2148f6a02b647da92d135e98e437c4ee45c058f8db5b35e68da5e820260f0176db337dd75f9beba07643791bdbdadf3b0f8
-
C:\Users\Admin\AppData\Roaming\3568807.exeMD5
fabab477a6e10cea86bc448c20e0d522
SHA124a1d01b18930308aa7ffd85f32c32171f5d3355
SHA2566dabfe3090b7dd3b0742c0db345e7eac9046c5e25ebc7246d94e7853d63f3518
SHA5128d7413b256ce16289535401fd6a7c2148f6a02b647da92d135e98e437c4ee45c058f8db5b35e68da5e820260f0176db337dd75f9beba07643791bdbdadf3b0f8
-
C:\Users\Admin\AppData\Roaming\8114088.exeMD5
1d095bc417db73c6bc6e4c4e7b43106f
SHA1db7e49df1fb5a0a665976f98ff7128aeba40c5f3
SHA256b529e11f2a855b7e7bca65ac994be9dc81191c7fe1b720addb90b98da33e7fee
SHA5123d255ee420aa7eb0f5f28e060d968bf4369f4be3fc8f07bd32c5482fea055e8103347440d41d17d847c5b2b2d3fb2e3a40356db1a33911c0b25828739a88a097
-
C:\Users\Admin\AppData\Roaming\8114088.exeMD5
1d095bc417db73c6bc6e4c4e7b43106f
SHA1db7e49df1fb5a0a665976f98ff7128aeba40c5f3
SHA256b529e11f2a855b7e7bca65ac994be9dc81191c7fe1b720addb90b98da33e7fee
SHA5123d255ee420aa7eb0f5f28e060d968bf4369f4be3fc8f07bd32c5482fea055e8103347440d41d17d847c5b2b2d3fb2e3a40356db1a33911c0b25828739a88a097
-
C:\Users\Admin\AppData\Roaming\8698367.exeMD5
faa4540e9de679f1ccebd8919086707b
SHA1244b5ca95e41f263e8357bb9ca5343623f07afe3
SHA256c1dd8fb190e95d8530a42bec831fcffbfdad0b6091d79008dc6828ef1587b44e
SHA51265f0d2baf3a3db9c77ed4607978e1ddae1513b60b1678fcab08bde0e1417f8381d62be2c546c9c674d3206fd5711e7482286831be93ccd8fd0abd137b2cab9ac
-
C:\Users\Admin\AppData\Roaming\8698367.exeMD5
faa4540e9de679f1ccebd8919086707b
SHA1244b5ca95e41f263e8357bb9ca5343623f07afe3
SHA256c1dd8fb190e95d8530a42bec831fcffbfdad0b6091d79008dc6828ef1587b44e
SHA51265f0d2baf3a3db9c77ed4607978e1ddae1513b60b1678fcab08bde0e1417f8381d62be2c546c9c674d3206fd5711e7482286831be93ccd8fd0abd137b2cab9ac
-
C:\Users\Admin\Documents\1S1NA2Zmby7lsGyRexfuLYjt.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
C:\Users\Admin\Documents\1S1NA2Zmby7lsGyRexfuLYjt.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exeMD5
f8d92d2f91fd134e57b6764c0eba5de3
SHA11ed71b2e5a398c1c1bc5f33cfe462d471a48fa52
SHA256420379eae2cab153a4f538c5c9b68d848e78d5c336c8e7e13a923913eb9ba32c
SHA51247d514492022932bb03f771d51bb1909235f9ebf7152b502e2412052628ff85c0342de42b4da8644c820b8bcf1e52fcace0fbc82c32c6216b4c2da56cf5eac71
-
C:\Users\Admin\Documents\4UdLc_mFcwqveMWoPB9bFRnK.exeMD5
f8d92d2f91fd134e57b6764c0eba5de3
SHA11ed71b2e5a398c1c1bc5f33cfe462d471a48fa52
SHA256420379eae2cab153a4f538c5c9b68d848e78d5c336c8e7e13a923913eb9ba32c
SHA51247d514492022932bb03f771d51bb1909235f9ebf7152b502e2412052628ff85c0342de42b4da8644c820b8bcf1e52fcace0fbc82c32c6216b4c2da56cf5eac71
-
C:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exeMD5
47e86cc0cafdce94d5c05a5c9c5c388e
SHA1de4fcbdcc06a0d748a82666bfc1ec4e4a08e5be6
SHA2561d7d718be5b978fedd1124fa44831ba54af5bda0507f6eee05a0a8c8d9badda1
SHA512e8d4012ee736c1d256e03bd1756ebd5a0349c0b77903bf71ad80cf40ee3c586e32b1e1278bd54b6b58b58152a9382a4726b8242b98ac4665ba1d0ebecb50e47e
-
C:\Users\Admin\Documents\58wjr4PU89QYrNHU_4CgnrYq.exeMD5
47e86cc0cafdce94d5c05a5c9c5c388e
SHA1de4fcbdcc06a0d748a82666bfc1ec4e4a08e5be6
SHA2561d7d718be5b978fedd1124fa44831ba54af5bda0507f6eee05a0a8c8d9badda1
SHA512e8d4012ee736c1d256e03bd1756ebd5a0349c0b77903bf71ad80cf40ee3c586e32b1e1278bd54b6b58b58152a9382a4726b8242b98ac4665ba1d0ebecb50e47e
-
C:\Users\Admin\Documents\9euI9Lu3UBMqFnhjQtXIU_y0.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\9euI9Lu3UBMqFnhjQtXIU_y0.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\T8xDAZMgqa3KJVG0JU7sPHTh.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\T8xDAZMgqa3KJVG0JU7sPHTh.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\_f2sJ5S2ZhEnlM42EeHXplIV.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\_f2sJ5S2ZhEnlM42EeHXplIV.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\bDqRzXdCTpLzYyoSz_dPvBT8.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\bDqRzXdCTpLzYyoSz_dPvBT8.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\lpWtbKjTpenAEX7sBF1KmRKX.exeMD5
908fa1446bc3cc61c7f05e0f56067705
SHA1195948e4b235aa486ffe4f3c22fa5bcea4bb8ea4
SHA256b2ff33ba5fb21b6ac2d560930be90451eb2197b75c781d162bf321149fe1323f
SHA512ee616b7b82177086ae749e145837eb895b5a9a1852830bed3f8d38939d4aa3c8b6a383b5be90e957a3fb5e4af298b108a0e7fa0ae1bcd4fe96791e137b0dcce0
-
C:\Users\Admin\Documents\lpWtbKjTpenAEX7sBF1KmRKX.exeMD5
908fa1446bc3cc61c7f05e0f56067705
SHA1195948e4b235aa486ffe4f3c22fa5bcea4bb8ea4
SHA256b2ff33ba5fb21b6ac2d560930be90451eb2197b75c781d162bf321149fe1323f
SHA512ee616b7b82177086ae749e145837eb895b5a9a1852830bed3f8d38939d4aa3c8b6a383b5be90e957a3fb5e4af298b108a0e7fa0ae1bcd4fe96791e137b0dcce0
-
C:\Users\Admin\Documents\oarWi7uU2p8LHM4_EpbluQY3.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\oarWi7uU2p8LHM4_EpbluQY3.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\x7FTjuwTomibB8p06AVC8eBD.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\x7FTjuwTomibB8p06AVC8eBD.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\x7FTjuwTomibB8p06AVC8eBD.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
memory/572-168-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/572-169-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/572-177-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/572-151-0x0000000000000000-mapping.dmp
-
memory/572-167-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/572-166-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/572-163-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/572-165-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/572-164-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/704-387-0x0000000000000000-mapping.dmp
-
memory/708-391-0x0000000000000000-mapping.dmp
-
memory/772-190-0x0000000000000000-mapping.dmp
-
memory/948-301-0x0000000000000000-mapping.dmp
-
memory/948-310-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/948-320-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/1124-389-0x0000000000000000-mapping.dmp
-
memory/1168-399-0x0000000000A30000-0x0000000000A42000-memory.dmpFilesize
72KB
-
memory/1168-398-0x0000000000A10000-0x0000000000A20000-memory.dmpFilesize
64KB
-
memory/1168-390-0x0000000000000000-mapping.dmp
-
memory/1428-674-0x0000000006C65000-0x0000000006C67000-memory.dmpFilesize
8KB
-
memory/1428-668-0x0000000006C60000-0x0000000006C61000-memory.dmpFilesize
4KB
-
memory/1428-669-0x0000000006C62000-0x0000000006C63000-memory.dmpFilesize
4KB
-
memory/1452-429-0x0000000000000000-mapping.dmp
-
memory/1780-527-0x0000000003810000-0x0000000003811000-memory.dmpFilesize
4KB
-
memory/1780-394-0x0000000000000000-mapping.dmp
-
memory/1780-571-0x0000000003815000-0x0000000003817000-memory.dmpFilesize
8KB
-
memory/1780-530-0x0000000003812000-0x0000000003813000-memory.dmpFilesize
4KB
-
memory/1780-406-0x00000000049A0000-0x0000000004A3D000-memory.dmpFilesize
628KB
-
memory/1892-396-0x0000000000000000-mapping.dmp
-
memory/1892-475-0x0000000005D80000-0x0000000005D81000-memory.dmpFilesize
4KB
-
memory/2164-515-0x00000000015B0000-0x0000000001ED6000-memory.dmpFilesize
9.1MB
-
memory/2164-400-0x0000000000000000-mapping.dmp
-
memory/2960-422-0x0000000000000000-mapping.dmp
-
memory/3100-318-0x0000000004B00000-0x0000000004B16000-memory.dmpFilesize
88KB
-
memory/3116-206-0x0000000000A10000-0x0000000000A19000-memory.dmpFilesize
36KB
-
memory/3116-187-0x0000000000000000-mapping.dmp
-
memory/3276-426-0x0000000000000000-mapping.dmp
-
memory/3472-198-0x0000000000000000-mapping.dmp
-
memory/3492-421-0x0000000000000000-mapping.dmp
-
memory/3620-378-0x00000000011B0000-0x00000000011B1000-memory.dmpFilesize
4KB
-
memory/3620-292-0x0000000000000000-mapping.dmp
-
memory/3824-192-0x0000000000000000-mapping.dmp
-
memory/3932-436-0x0000000005860000-0x0000000005E78000-memory.dmpFilesize
6.1MB
-
memory/3932-407-0x0000000000000000-mapping.dmp
-
memory/4112-182-0x0000000000000000-mapping.dmp
-
memory/4160-712-0x00000000066D0000-0x00000000066D1000-memory.dmpFilesize
4KB
-
memory/4344-149-0x0000000000000000-mapping.dmp
-
memory/4440-377-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/4440-321-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/4440-341-0x0000000007120000-0x0000000007152000-memory.dmpFilesize
200KB
-
memory/4440-300-0x0000000000000000-mapping.dmp
-
memory/4444-179-0x0000000000000000-mapping.dmp
-
memory/4444-296-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4444-274-0x0000000000000000-mapping.dmp
-
memory/4452-176-0x0000000000000000-mapping.dmp
-
memory/4452-470-0x0000000000000000-mapping.dmp
-
memory/4460-469-0x0000000000000000-mapping.dmp
-
memory/4464-178-0x0000000000000000-mapping.dmp
-
memory/4568-546-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/4656-181-0x0000000000000000-mapping.dmp
-
memory/4736-200-0x000000001B600000-0x000000001B602000-memory.dmpFilesize
8KB
-
memory/4736-196-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/4736-191-0x0000000000000000-mapping.dmp
-
memory/4796-180-0x0000000000000000-mapping.dmp
-
memory/4904-185-0x0000000000000000-mapping.dmp
-
memory/4924-204-0x0000000000B90000-0x0000000000C2D000-memory.dmpFilesize
628KB
-
memory/4924-184-0x0000000000000000-mapping.dmp
-
memory/4952-146-0x0000000000000000-mapping.dmp
-
memory/4984-183-0x0000000000000000-mapping.dmp
-
memory/5192-201-0x0000000000000000-mapping.dmp
-
memory/5236-484-0x0000024D1B2E0000-0x0000024D1B3AF000-memory.dmpFilesize
828KB
-
memory/5236-425-0x0000000000000000-mapping.dmp
-
memory/5244-261-0x0000000000000000-mapping.dmp
-
memory/5268-401-0x0000000000000000-mapping.dmp
-
memory/5268-416-0x000000001BA70000-0x000000001BA72000-memory.dmpFilesize
8KB
-
memory/5296-339-0x0000000000000000-mapping.dmp
-
memory/5320-434-0x0000000000000000-mapping.dmp
-
memory/5368-207-0x0000000000000000-mapping.dmp
-
memory/5384-285-0x0000000000000000-mapping.dmp
-
memory/5384-334-0x00000000028F0000-0x0000000002924000-memory.dmpFilesize
208KB
-
memory/5384-317-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/5384-305-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/5384-327-0x000000001B710000-0x000000001B712000-memory.dmpFilesize
8KB
-
memory/5384-346-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/5396-349-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/5396-347-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/5396-322-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/5396-326-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/5396-314-0x00000000021A0000-0x00000000021A1000-memory.dmpFilesize
4KB
-
memory/5396-286-0x0000000000000000-mapping.dmp
-
memory/5396-337-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/5396-359-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/5396-362-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/5396-329-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/5396-333-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/5396-331-0x0000000005A80000-0x0000000005A81000-memory.dmpFilesize
4KB
-
memory/5396-335-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/5396-336-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/5396-354-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/5396-357-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/5396-350-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/5396-307-0x00000000031C0000-0x00000000031FC000-memory.dmpFilesize
240KB
-
memory/5396-348-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/5396-344-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/5396-338-0x0000000005AD0000-0x0000000005AD1000-memory.dmpFilesize
4KB
-
memory/5400-328-0x0000000002500000-0x0000000002502000-memory.dmpFilesize
8KB
-
memory/5400-319-0x000000001B3F0000-0x000000001B3F1000-memory.dmpFilesize
4KB
-
memory/5400-309-0x00000000024D0000-0x00000000024FB000-memory.dmpFilesize
172KB
-
memory/5400-280-0x0000000000000000-mapping.dmp
-
memory/5400-325-0x000000001BAF0000-0x000000001BAF1000-memory.dmpFilesize
4KB
-
memory/5400-291-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/5400-342-0x000000001B270000-0x000000001B271000-memory.dmpFilesize
4KB
-
memory/5424-474-0x0000000000000000-mapping.dmp
-
memory/5472-427-0x0000000000000000-mapping.dmp
-
memory/5504-283-0x0000000000000000-mapping.dmp
-
memory/5504-304-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/5504-312-0x00000000011D0000-0x00000000011D7000-memory.dmpFilesize
28KB
-
memory/5560-386-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/5560-368-0x0000000000000000-mapping.dmp
-
memory/5568-482-0x0000000000000000-mapping.dmp
-
memory/5600-473-0x00000000034C0000-0x00000000034C1000-memory.dmpFilesize
4KB
-
memory/5600-395-0x0000000000000000-mapping.dmp
-
memory/5624-476-0x0000000000000000-mapping.dmp
-
memory/5624-501-0x000000001B170000-0x000000001B172000-memory.dmpFilesize
8KB
-
memory/5632-345-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/5632-340-0x0000000000000000-mapping.dmp
-
memory/5728-211-0x0000000000000000-mapping.dmp
-
memory/5728-299-0x0000026A5B590000-0x0000026A5B5FF000-memory.dmpFilesize
444KB
-
memory/5728-302-0x0000026A5B600000-0x0000026A5B6CF000-memory.dmpFilesize
828KB
-
memory/5740-237-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/5740-254-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/5740-267-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/5740-232-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/5740-264-0x0000000005230000-0x00000000052C2000-memory.dmpFilesize
584KB
-
memory/5740-244-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/5740-212-0x0000000000000000-mapping.dmp
-
memory/5740-256-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB
-
memory/5752-213-0x0000000000000000-mapping.dmp
-
memory/5752-243-0x0000000004880000-0x000000000491D000-memory.dmpFilesize
628KB
-
memory/5764-268-0x00000000053D0000-0x0000000005976000-memory.dmpFilesize
5.6MB
-
memory/5764-231-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/5764-271-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/5764-214-0x0000000000000000-mapping.dmp
-
memory/5776-278-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/5776-215-0x0000000000000000-mapping.dmp
-
memory/5776-272-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/5776-316-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/5776-275-0x0000000005F60000-0x0000000005F61000-memory.dmpFilesize
4KB
-
memory/5776-323-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/5776-290-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/5776-284-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/5788-249-0x0000000002D80000-0x0000000002D8A000-memory.dmpFilesize
40KB
-
memory/5788-216-0x0000000000000000-mapping.dmp
-
memory/5812-219-0x0000000000000000-mapping.dmp
-
memory/5812-253-0x0000000000940000-0x0000000000955000-memory.dmpFilesize
84KB
-
memory/5812-266-0x000000001AED0000-0x000000001AED2000-memory.dmpFilesize
8KB
-
memory/5812-235-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/6048-240-0x0000000000000000-mapping.dmp
-
memory/6048-245-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/6104-241-0x0000000000000000-mapping.dmp
-
memory/6104-265-0x0000000002E50000-0x0000000002E59000-memory.dmpFilesize
36KB
-
memory/6124-414-0x0000000000000000-mapping.dmp
-
memory/6124-464-0x000001E202DB0000-0x000001E202E7F000-memory.dmpFilesize
828KB
-
memory/6124-463-0x000001E202D40000-0x000001E202DAE000-memory.dmpFilesize
440KB
-
memory/6128-269-0x000000001BA60000-0x000000001BA62000-memory.dmpFilesize
8KB
-
memory/6128-260-0x0000000002CB0000-0x0000000002CC5000-memory.dmpFilesize
84KB
-
memory/6128-258-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/6128-242-0x0000000000000000-mapping.dmp