Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
123s -
max time network
472s -
platform
windows11_x64 -
resource
win11 -
submitted
13-08-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
8 (3).exe
Resource
win11
Behavioral task
behavioral2
Sample
8 (30).exe
Resource
win11
Behavioral task
behavioral3
Sample
8 (31).exe
Resource
win11
Errors
General
-
Target
8 (30).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/740-399-0x0000000001510000-0x0000000001E36000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXerUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1212 4972 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5488 4972 rUNdlL32.eXe -
Raccoon Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2016-409-0x0000000004A80000-0x0000000004B13000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\_Zc9whaKfl_JLWu6W0FAWmK1.exe family_redline C:\Users\Admin\Documents\aExdCfNXucfonbOOac2PuG9P.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeX5Gdy6gNFU_e8he4pTThuaQ7.exeWerFault.exe5891405.exeCleaner Installation.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 4768 created 4100 4768 WerFault.exe setup_install.exe PID 4656 created 2528 4656 WerFault.exe sonia_2.exe PID 4752 created 3608 4752 WerFault.exe sonia_3.exe PID 3572 created 5072 3572 X5Gdy6gNFU_e8he4pTThuaQ7.exe aExdCfNXucfonbOOac2PuG9P.exe PID 4564 created 672 4564 WerFault.exe SiJIi3_WqIkqQvI5QPMCmoGS.exe PID 1992 created 3196 1992 5891405.exe SYQiuZH20mLYHs2aooMg596X.exe PID 1388 created 1188 1388 Cleaner Installation.exe NVdmt6iXrXMJzlA2t58Tdg3O.exe PID 1736 created 460 1736 WerFault.exe 2p7n8ODwQ7ewZod5XCq7_Pyh.exe PID 2520 created 3188 2520 WerFault.exe md8_8eus.exe PID 3476 created 740 3476 WerFault.exe 11111.exe PID 912 created 2016 912 WerFault.exe GameBox64bit.exe PID 1536 created 5020 1536 WerFault.exe X5Gdy6gNFU_e8he4pTThuaQ7.exe PID 5688 created 5548 5688 WerFault.exe rundll32.exe PID 3784 created 4396 3784 WerFault.exe 8499124.exe PID 4960 created 1488 4960 WerFault.exe 3369564.exe PID 6112 created 1108 6112 WerFault.exe 1206345.exe PID 2148 created 5116 2148 WerFault.exe 6440941.exe PID 6024 created 5024 6024 WerFault.exe 6887135.exe PID 4752 created 5536 4752 WerFault.exe F0EE.exe PID 788 created 5212 788 WerFault.exe 8867950.exe PID 2508 created 3268 2508 WerFault.exe F98A.exe PID 2304 created 4260 2304 WerFault.exe 322.exe PID 5444 created 1524 5444 WerFault.exe explorer.exe -
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Nirsoft 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2284-363-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft -
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3608-206-0x0000000000AD0000-0x0000000000B6D000-memory.dmp family_vidar behavioral2/memory/672-256-0x00000000049A0000-0x0000000004A3D000-memory.dmp family_vidar behavioral2/memory/3196-280-0x00000000049C0000-0x0000000004A5D000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurlpp.dll aspack_v212_v242 -
Blocklisted process makes network request 7 IoCs
Processes:
MsiExec.exeflow pid process 154 5272 MsiExec.exe 155 5272 MsiExec.exe 157 5272 MsiExec.exe 158 5272 MsiExec.exe 159 5272 MsiExec.exe 163 5272 MsiExec.exe 164 5272 MsiExec.exe -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exesonia_1.exesonia_2.exesonia_4.exesonia_5.exesonia_3.exesonia_6.exesonia_1.exejfiag3g_gg.exeSiJIi3_WqIkqQvI5QPMCmoGS.exeHrIx13CSTMzqSnRS8QfzeiKD.exeX5Gdy6gNFU_e8he4pTThuaQ7.exen89VBckFKsj9xfDOZqaqaA1P.exeGameBox.exekRiLghXv_6ASLkGhyEhBWRyk.exe_Zc9whaKfl_JLWu6W0FAWmK1.exe11111.exeaExdCfNXucfonbOOac2PuG9P.exeKi5oiMd0OUghu0IYj3jTOKQO.exenm4v4nX6q8r69thUpH5Vd9Ga.exeX2_TPiNnV6_dYtMnZrxSY0hp.exeSYQiuZH20mLYHs2aooMg596X.exeNVdmt6iXrXMJzlA2t58Tdg3O.exe2p7n8ODwQ7ewZod5XCq7_Pyh.exe1JMmnCx5m4Z66yrXg1xiG_Zg.exekRiLghXv_6ASLkGhyEhBWRyk.exejfiag3g_gg.exeS_E0CVI67McL3LWYzINfS7m4.execustomer3.exemd8_8eus.exejooyu.exeS_E0CVI67McL3LWYzINfS7m4.tmpvO2_yRX_ZljMrGdzV5L7u2tB.exe3369564.exe8499124.exe7749277.exe8892045.exejfiag3g_gg.exe1895660.exe11111.exe6440941.exeSetup.exe1206345.exe5891405.exeGameBox64bit.exeGameBoxWin64.exeWeather Installation.exe11111.exeGameBox32Bit.exeBotCheck.exenote8876.exeGameBoxWin32.exeCleaner Installation.exeWinHoster.exeGameBoxWin32.tmpX5Gdy6gNFU_e8he4pTThuaQ7.exejfiag3g_gg.exeBotCheck.exe6887135.exe2289649.exe6887761.exepid process 4924 setup_installer.exe 4100 setup_install.exe 2088 sonia_1.exe 2528 sonia_2.exe 3616 sonia_4.exe 5052 sonia_5.exe 3608 sonia_3.exe 5104 sonia_6.exe 3852 sonia_1.exe 3784 jfiag3g_gg.exe 672 SiJIi3_WqIkqQvI5QPMCmoGS.exe 3036 HrIx13CSTMzqSnRS8QfzeiKD.exe 3572 X5Gdy6gNFU_e8he4pTThuaQ7.exe 5092 n89VBckFKsj9xfDOZqaqaA1P.exe 3864 GameBox.exe 4464 kRiLghXv_6ASLkGhyEhBWRyk.exe 916 _Zc9whaKfl_JLWu6W0FAWmK1.exe 740 11111.exe 5072 aExdCfNXucfonbOOac2PuG9P.exe 664 Ki5oiMd0OUghu0IYj3jTOKQO.exe 592 nm4v4nX6q8r69thUpH5Vd9Ga.exe 2544 X2_TPiNnV6_dYtMnZrxSY0hp.exe 3196 SYQiuZH20mLYHs2aooMg596X.exe 1188 NVdmt6iXrXMJzlA2t58Tdg3O.exe 460 2p7n8ODwQ7ewZod5XCq7_Pyh.exe 4584 1JMmnCx5m4Z66yrXg1xiG_Zg.exe 3656 kRiLghXv_6ASLkGhyEhBWRyk.exe 1708 jfiag3g_gg.exe 1292 S_E0CVI67McL3LWYzINfS7m4.exe 3020 customer3.exe 3188 md8_8eus.exe 1068 jooyu.exe 940 S_E0CVI67McL3LWYzINfS7m4.tmp 3376 vO2_yRX_ZljMrGdzV5L7u2tB.exe 1488 3369564.exe 4396 8499124.exe 3244 7749277.exe 2012 8892045.exe 3416 jfiag3g_gg.exe 3904 1895660.exe 2284 11111.exe 5116 6440941.exe 1952 Setup.exe 1108 1206345.exe 1992 5891405.exe 2016 GameBox64bit.exe 3736 GameBoxWin64.exe 1632 Weather Installation.exe 1956 11111.exe 3864 GameBox.exe 2712 GameBox32Bit.exe 4868 BotCheck.exe 3592 note8876.exe 3200 GameBoxWin32.exe 1388 Cleaner Installation.exe 1824 WinHoster.exe 4336 GameBoxWin32.tmp 5020 X5Gdy6gNFU_e8he4pTThuaQ7.exe 5088 jfiag3g_gg.exe 3204 BotCheck.exe 740 11111.exe 5024 6887135.exe 2084 2289649.exe 5172 6887761.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule behavioral2/memory/3188-299-0x0000000000400000-0x000000000067D000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
aExdCfNXucfonbOOac2PuG9P.exe_Zc9whaKfl_JLWu6W0FAWmK1.exeX2_TPiNnV6_dYtMnZrxSY0hp.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion aExdCfNXucfonbOOac2PuG9P.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion aExdCfNXucfonbOOac2PuG9P.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion _Zc9whaKfl_JLWu6W0FAWmK1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion _Zc9whaKfl_JLWu6W0FAWmK1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion X2_TPiNnV6_dYtMnZrxSY0hp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion X2_TPiNnV6_dYtMnZrxSY0hp.exe -
Drops startup file 2 IoCs
Processes:
customer3.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe -
Loads dropped DLL 46 IoCs
Processes:
setup_install.exerundll32.exeS_E0CVI67McL3LWYzINfS7m4.tmpWeather Installation.exeGameBoxWin64.exeCleaner Installation.exeGameBoxWin32.tmprundll32.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeFD06.exeWeather_Installation.exeWeather.exepid process 4100 setup_install.exe 4100 setup_install.exe 4100 setup_install.exe 4100 setup_install.exe 4100 setup_install.exe 4100 setup_install.exe 5072 rundll32.exe 940 S_E0CVI67McL3LWYzINfS7m4.tmp 940 S_E0CVI67McL3LWYzINfS7m4.tmp 1632 Weather Installation.exe 3736 GameBoxWin64.exe 3736 GameBoxWin64.exe 1388 Cleaner Installation.exe 4336 GameBoxWin32.tmp 5548 rundll32.exe 3736 GameBoxWin64.exe 6008 MsiExec.exe 6008 MsiExec.exe 5428 MsiExec.exe 5428 MsiExec.exe 5428 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 4720 MsiExec.exe 4720 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 5272 MsiExec.exe 5420 FD06.exe 3104 Weather_Installation.exe 3104 Weather_Installation.exe 3104 Weather_Installation.exe 5420 FD06.exe 5420 FD06.exe 3104 Weather_Installation.exe 3104 Weather_Installation.exe 4080 Weather.exe 3104 Weather_Installation.exe 3104 Weather_Installation.exe 4080 Weather.exe 4080 Weather.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\_Zc9whaKfl_JLWu6W0FAWmK1.exe themida C:\Users\Admin\Documents\X2_TPiNnV6_dYtMnZrxSY0hp.exe themida C:\Users\Admin\Documents\aExdCfNXucfonbOOac2PuG9P.exe themida behavioral2/memory/2544-305-0x00000000003B0000-0x00000000003B1000-memory.dmp themida behavioral2/memory/5072-309-0x0000000001000000-0x0000000001001000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
sonia_6.exe7749277.exeaipackagechainer.exeWeather_Installation.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 7749277.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Weather_Installation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Weather = "C:\\Users\\Admin\\AppData\\Roaming\\Weather\\Weather.exe --Kx45G9qPr" Weather_Installation.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
X2_TPiNnV6_dYtMnZrxSY0hp.exeaExdCfNXucfonbOOac2PuG9P.exe_Zc9whaKfl_JLWu6W0FAWmK1.exenote8876.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA X2_TPiNnV6_dYtMnZrxSY0hp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aExdCfNXucfonbOOac2PuG9P.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA _Zc9whaKfl_JLWu6W0FAWmK1.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA note8876.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exeWeather Installation.exeCleaner Installation.exeGameBoxWin64.exedescription ioc process File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\J: Weather Installation.exe File opened (read-only) \??\Z: Weather Installation.exe File opened (read-only) \??\O: Cleaner Installation.exe File opened (read-only) \??\A: Weather Installation.exe File opened (read-only) \??\V: Cleaner Installation.exe File opened (read-only) \??\I: GameBoxWin64.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: Weather Installation.exe File opened (read-only) \??\X: Weather Installation.exe File opened (read-only) \??\G: Cleaner Installation.exe File opened (read-only) \??\O: GameBoxWin64.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: Weather Installation.exe File opened (read-only) \??\Q: Weather Installation.exe File opened (read-only) \??\Y: Weather Installation.exe File opened (read-only) \??\U: Cleaner Installation.exe File opened (read-only) \??\B: GameBoxWin64.exe File opened (read-only) \??\Q: GameBoxWin64.exe File opened (read-only) \??\R: GameBoxWin64.exe File opened (read-only) \??\E: Weather Installation.exe File opened (read-only) \??\K: GameBoxWin64.exe File opened (read-only) \??\W: GameBoxWin64.exe File opened (read-only) \??\O: Weather Installation.exe File opened (read-only) \??\Z: Cleaner Installation.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: Weather Installation.exe File opened (read-only) \??\E: GameBoxWin64.exe File opened (read-only) \??\G: GameBoxWin64.exe File opened (read-only) \??\N: GameBoxWin64.exe File opened (read-only) \??\S: GameBoxWin64.exe File opened (read-only) \??\K: Weather Installation.exe File opened (read-only) \??\J: Cleaner Installation.exe File opened (read-only) \??\P: Cleaner Installation.exe File opened (read-only) \??\Y: Cleaner Installation.exe File opened (read-only) \??\H: GameBoxWin64.exe File opened (read-only) \??\P: GameBoxWin64.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: Weather Installation.exe File opened (read-only) \??\F: Cleaner Installation.exe File opened (read-only) \??\N: Cleaner Installation.exe File opened (read-only) \??\Q: Cleaner Installation.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\B: Weather Installation.exe File opened (read-only) \??\F: Weather Installation.exe File opened (read-only) \??\H: Weather Installation.exe File opened (read-only) \??\E: Cleaner Installation.exe File opened (read-only) \??\H: Cleaner Installation.exe File opened (read-only) \??\L: Cleaner Installation.exe File opened (read-only) \??\T: Cleaner Installation.exe File opened (read-only) \??\F: GameBoxWin64.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: Cleaner Installation.exe File opened (read-only) \??\K: Cleaner Installation.exe File opened (read-only) \??\M: GameBoxWin64.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 83 ipinfo.io 2 ip-api.com 8 ipinfo.io 11 ipinfo.io -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
X2_TPiNnV6_dYtMnZrxSY0hp.exeaExdCfNXucfonbOOac2PuG9P.exe_Zc9whaKfl_JLWu6W0FAWmK1.exepid process 2544 X2_TPiNnV6_dYtMnZrxSY0hp.exe 5072 aExdCfNXucfonbOOac2PuG9P.exe 916 _Zc9whaKfl_JLWu6W0FAWmK1.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
kRiLghXv_6ASLkGhyEhBWRyk.exeX5Gdy6gNFU_e8he4pTThuaQ7.exeFD06.exeHrIx13CSTMzqSnRS8QfzeiKD.exedescription pid process target process PID 4464 set thread context of 3656 4464 kRiLghXv_6ASLkGhyEhBWRyk.exe kRiLghXv_6ASLkGhyEhBWRyk.exe PID 3572 set thread context of 5020 3572 X5Gdy6gNFU_e8he4pTThuaQ7.exe X5Gdy6gNFU_e8he4pTThuaQ7.exe PID 2372 set thread context of 5420 2372 FD06.exe FD06.exe PID 3036 set thread context of 4960 3036 HrIx13CSTMzqSnRS8QfzeiKD.exe HrIx13CSTMzqSnRS8QfzeiKD.exe -
Drops file in Program Files directory 23 IoCs
Processes:
1JMmnCx5m4Z66yrXg1xiG_Zg.exeSetup.exenote8876.exeHrIx13CSTMzqSnRS8QfzeiKD.exedescription ioc process File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe 1JMmnCx5m4Z66yrXg1xiG_Zg.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d note8876.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe 1JMmnCx5m4Z66yrXg1xiG_Zg.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini 1JMmnCx5m4Z66yrXg1xiG_Zg.exe File created C:\Program Files (x86)\GameBox INC\GameBox\d note8876.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d.INTEG.RAW note8876.exe File created C:\Program Files (x86)\GameBox INC\GameBox\tmp.edb note8876.exe File created C:\Program Files (x86)\GameBox INC\GameBox\d.jfm note8876.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d.jfm note8876.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe 1JMmnCx5m4Z66yrXg1xiG_Zg.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe 1JMmnCx5m4Z66yrXg1xiG_Zg.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe Setup.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\resources.pak HrIx13CSTMzqSnRS8QfzeiKD.exe -
Drops file in Windows directory 26 IoCs
Processes:
msiexec.exeWerFault.exesvchost.exedescription ioc process File created C:\Windows\Installer\f74e66e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF563.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI76D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4ED8.tmp msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Installer\MSIF6BC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF7E6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI41E.tmp msiexec.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.override svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst svchost.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF013.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF93E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4AB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI50A.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF9A87D2CFA9B3ABED.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File created C:\Windows\SystemTemp\~DFFCFB29CBEDC3AAFD.TMP msiexec.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp svchost.exe File created C:\Windows\SystemTemp\~DFE727E7B6D18AA69F.TMP msiexec.exe File opened for modification C:\Windows\Installer\f74e66e.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFAC6.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI605.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF53650BBE070BD8E5.TMP msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 23 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4580 4100 WerFault.exe setup_install.exe 4620 2528 WerFault.exe sonia_2.exe 3204 3608 WerFault.exe sonia_3.exe 3144 5072 WerFault.exe rundll32.exe 1632 672 WerFault.exe SiJIi3_WqIkqQvI5QPMCmoGS.exe 3680 3196 WerFault.exe SYQiuZH20mLYHs2aooMg596X.exe 2928 1188 WerFault.exe NVdmt6iXrXMJzlA2t58Tdg3O.exe 3184 460 WerFault.exe 2p7n8ODwQ7ewZod5XCq7_Pyh.exe 344 3188 WerFault.exe md8_8eus.exe 3712 740 WerFault.exe UgLqpNcd72FQ5h4nmHT3P_Zo.exe 1508 2016 WerFault.exe GameBox64bit.exe 788 5020 WerFault.exe X5Gdy6gNFU_e8he4pTThuaQ7.exe 5884 5548 WerFault.exe rundll32.exe 6016 4396 WerFault.exe 8499124.exe 1832 1488 WerFault.exe 3369564.exe 5980 1108 WerFault.exe 1206345.exe 5584 5116 WerFault.exe 6440941.exe 5320 5024 WerFault.exe 6887135.exe 2004 5536 WerFault.exe F0EE.exe 5768 5212 WerFault.exe 8867950.exe 4528 4260 WerFault.exe 322.exe 2904 3268 WerFault.exe F98A.exe 5888 1524 WerFault.exe explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
kRiLghXv_6ASLkGhyEhBWRyk.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI kRiLghXv_6ASLkGhyEhBWRyk.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI kRiLghXv_6ASLkGhyEhBWRyk.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI kRiLghXv_6ASLkGhyEhBWRyk.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeexplorer.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWeather Installation.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Weather Installation.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Weather Installation.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5636 timeout.exe -
Enumerates system info in registry 2 TTPs 46 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeexplorer.exeWerFault.exeWerFault.exeWerFault.exeWeather Installation.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU explorer.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Weather Installation.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Weather Installation.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
svchost.exesvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe -
Modifies registry class 4 IoCs
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ -
Processes:
Weather Installation.exeGameBoxWin64.exeCleaner Installation.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B Weather Installation.exe Set value (data) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Weather Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Weather Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Weather Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e5c0000000100000004000000001000002000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Weather Installation.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 82 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 84 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exekRiLghXv_6ASLkGhyEhBWRyk.exejfiag3g_gg.exeWeather Installation.exeWerFault.exeWerFault.exepid process 4620 WerFault.exe 4620 WerFault.exe 3204 WerFault.exe 3204 WerFault.exe 4580 WerFault.exe 4580 WerFault.exe 3144 WerFault.exe 3144 WerFault.exe 3656 kRiLghXv_6ASLkGhyEhBWRyk.exe 3656 kRiLghXv_6ASLkGhyEhBWRyk.exe 1708 jfiag3g_gg.exe 1708 jfiag3g_gg.exe 1632 Weather Installation.exe 1632 Weather Installation.exe 3208 3208 3208 3208 3208 3208 3680 WerFault.exe 3680 WerFault.exe 2928 WerFault.exe 2928 WerFault.exe 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3208 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
kRiLghXv_6ASLkGhyEhBWRyk.exepid process 3656 kRiLghXv_6ASLkGhyEhBWRyk.exe 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 3208 -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
2289649.exepid process 2084 2289649.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exesonia_4.exeWerFault.exeGameBox.exenm4v4nX6q8r69thUpH5Vd9Ga.exevO2_yRX_ZljMrGdzV5L7u2tB.exeX2_TPiNnV6_dYtMnZrxSY0hp.exeaExdCfNXucfonbOOac2PuG9P.exe8499124.exe3369564.exe6440941.exedescription pid process Token: SeSystemEnvironmentPrivilege 4812 svchost.exe Token: SeDebugPrivilege 3616 sonia_4.exe Token: SeRestorePrivilege 4580 WerFault.exe Token: SeBackupPrivilege 4580 WerFault.exe Token: SeRestorePrivilege 4580 WerFault.exe Token: SeBackupPrivilege 4580 WerFault.exe Token: SeBackupPrivilege 4580 WerFault.exe Token: SeDebugPrivilege 3864 GameBox.exe Token: SeDebugPrivilege 592 nm4v4nX6q8r69thUpH5Vd9Ga.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeDebugPrivilege 3376 vO2_yRX_ZljMrGdzV5L7u2tB.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeDebugPrivilege 2544 X2_TPiNnV6_dYtMnZrxSY0hp.exe Token: SeDebugPrivilege 5072 aExdCfNXucfonbOOac2PuG9P.exe Token: SeDebugPrivilege 4396 8499124.exe Token: SeDebugPrivilege 1488 3369564.exe Token: SeDebugPrivilege 5116 6440941.exe Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 Token: SeCreatePagefilePrivilege 3208 Token: SeShutdownPrivilege 3208 -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
S_E0CVI67McL3LWYzINfS7m4.tmpWeather Installation.exeGameBoxWin64.exeCleaner Installation.exepid process 940 S_E0CVI67McL3LWYzINfS7m4.tmp 1632 Weather Installation.exe 3736 GameBoxWin64.exe 1388 Cleaner Installation.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
E768.exepid process 2532 E768.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8 (30).exesetup_installer.exesvchost.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exeWerFault.exesonia_1.exesonia_6.exeWerFault.exeWerFault.exerUNdlL32.eXeX5Gdy6gNFU_e8he4pTThuaQ7.exesonia_5.exedescription pid process target process PID 3248 wrote to memory of 4924 3248 8 (30).exe setup_installer.exe PID 3248 wrote to memory of 4924 3248 8 (30).exe setup_installer.exe PID 3248 wrote to memory of 4924 3248 8 (30).exe setup_installer.exe PID 4924 wrote to memory of 4100 4924 setup_installer.exe setup_install.exe PID 4924 wrote to memory of 4100 4924 setup_installer.exe setup_install.exe PID 4924 wrote to memory of 4100 4924 setup_installer.exe setup_install.exe PID 3968 wrote to memory of 4704 3968 svchost.exe pcaui.exe PID 3968 wrote to memory of 4704 3968 svchost.exe pcaui.exe PID 4100 wrote to memory of 788 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 788 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 788 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 3200 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 3200 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 3200 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 888 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 888 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 888 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1104 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1104 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1104 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1516 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1516 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1516 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1200 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1200 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 1200 4100 setup_install.exe cmd.exe PID 788 wrote to memory of 2088 788 cmd.exe sonia_1.exe PID 788 wrote to memory of 2088 788 cmd.exe sonia_1.exe PID 788 wrote to memory of 2088 788 cmd.exe sonia_1.exe PID 4100 wrote to memory of 2560 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 2560 4100 setup_install.exe cmd.exe PID 4100 wrote to memory of 2560 4100 setup_install.exe cmd.exe PID 3200 wrote to memory of 2528 3200 cmd.exe sonia_2.exe PID 3200 wrote to memory of 2528 3200 cmd.exe sonia_2.exe PID 3200 wrote to memory of 2528 3200 cmd.exe sonia_2.exe PID 1104 wrote to memory of 3616 1104 cmd.exe sonia_4.exe PID 1104 wrote to memory of 3616 1104 cmd.exe sonia_4.exe PID 888 wrote to memory of 3608 888 cmd.exe sonia_3.exe PID 888 wrote to memory of 3608 888 cmd.exe sonia_3.exe PID 888 wrote to memory of 3608 888 cmd.exe sonia_3.exe PID 1516 wrote to memory of 5052 1516 cmd.exe sonia_5.exe PID 1516 wrote to memory of 5052 1516 cmd.exe sonia_5.exe PID 1516 wrote to memory of 5052 1516 cmd.exe sonia_5.exe PID 1200 wrote to memory of 5104 1200 cmd.exe sonia_6.exe PID 1200 wrote to memory of 5104 1200 cmd.exe sonia_6.exe PID 1200 wrote to memory of 5104 1200 cmd.exe sonia_6.exe PID 4768 wrote to memory of 4100 4768 WerFault.exe setup_install.exe PID 4768 wrote to memory of 4100 4768 WerFault.exe setup_install.exe PID 2088 wrote to memory of 3852 2088 sonia_1.exe sonia_1.exe PID 2088 wrote to memory of 3852 2088 sonia_1.exe sonia_1.exe PID 2088 wrote to memory of 3852 2088 sonia_1.exe sonia_1.exe PID 5104 wrote to memory of 3784 5104 sonia_6.exe jfiag3g_gg.exe PID 5104 wrote to memory of 3784 5104 sonia_6.exe jfiag3g_gg.exe PID 5104 wrote to memory of 3784 5104 sonia_6.exe jfiag3g_gg.exe PID 4656 wrote to memory of 2528 4656 WerFault.exe sonia_2.exe PID 4656 wrote to memory of 2528 4656 WerFault.exe sonia_2.exe PID 4752 wrote to memory of 3608 4752 WerFault.exe sonia_3.exe PID 4752 wrote to memory of 3608 4752 WerFault.exe sonia_3.exe PID 1212 wrote to memory of 5072 1212 rUNdlL32.eXe rundll32.exe PID 1212 wrote to memory of 5072 1212 rUNdlL32.eXe rundll32.exe PID 1212 wrote to memory of 5072 1212 rUNdlL32.eXe rundll32.exe PID 3572 wrote to memory of 5072 3572 X5Gdy6gNFU_e8he4pTThuaQ7.exe aExdCfNXucfonbOOac2PuG9P.exe PID 3572 wrote to memory of 5072 3572 X5Gdy6gNFU_e8he4pTThuaQ7.exe aExdCfNXucfonbOOac2PuG9P.exe PID 5052 wrote to memory of 672 5052 sonia_5.exe SiJIi3_WqIkqQvI5QPMCmoGS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8 (30).exe"C:\Users\Admin\AppData\Local\Temp\8 (30).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 2446⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 2406⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\n89VBckFKsj9xfDOZqaqaA1P.exe"C:\Users\Admin\Documents\n89VBckFKsj9xfDOZqaqaA1P.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\Documents\X5Gdy6gNFU_e8he4pTThuaQ7.exe"C:\Users\Admin\Documents\X5Gdy6gNFU_e8he4pTThuaQ7.exe"6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\X5Gdy6gNFU_e8he4pTThuaQ7.exeC:\Users\Admin\Documents\X5Gdy6gNFU_e8he4pTThuaQ7.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 288⤵
- Program crash
-
C:\Users\Admin\Documents\HrIx13CSTMzqSnRS8QfzeiKD.exe"C:\Users\Admin\Documents\HrIx13CSTMzqSnRS8QfzeiKD.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\HrIx13CSTMzqSnRS8QfzeiKD.exe"C:\Users\Admin\Documents\HrIx13CSTMzqSnRS8QfzeiKD.exe"7⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\SiJIi3_WqIkqQvI5QPMCmoGS.exe"C:\Users\Admin\Documents\SiJIi3_WqIkqQvI5QPMCmoGS.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 2767⤵
- Program crash
-
C:\Users\Admin\Documents\uJ9mYHAvuwIgAm_x05uSaMSM.exe"C:\Users\Admin\Documents\uJ9mYHAvuwIgAm_x05uSaMSM.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\8499124.exe"C:\Users\Admin\AppData\Roaming\8499124.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4396 -s 23408⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\7749277.exe"C:\Users\Admin\AppData\Roaming\7749277.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1895660.exe"C:\Users\Admin\AppData\Roaming\1895660.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6440941.exe"C:\Users\Admin\AppData\Roaming\6440941.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 25488⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\kRiLghXv_6ASLkGhyEhBWRyk.exe"C:\Users\Admin\Documents\kRiLghXv_6ASLkGhyEhBWRyk.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\kRiLghXv_6ASLkGhyEhBWRyk.exe"C:\Users\Admin\Documents\kRiLghXv_6ASLkGhyEhBWRyk.exe"7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\_Zc9whaKfl_JLWu6W0FAWmK1.exe"C:\Users\Admin\Documents\_Zc9whaKfl_JLWu6W0FAWmK1.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\UgLqpNcd72FQ5h4nmHT3P_Zo.exe"C:\Users\Admin\Documents\UgLqpNcd72FQ5h4nmHT3P_Zo.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\X2_TPiNnV6_dYtMnZrxSY0hp.exe"C:\Users\Admin\Documents\X2_TPiNnV6_dYtMnZrxSY0hp.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Ki5oiMd0OUghu0IYj3jTOKQO.exe"C:\Users\Admin\Documents\Ki5oiMd0OUghu0IYj3jTOKQO.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\nm4v4nX6q8r69thUpH5Vd9Ga.exe"C:\Users\Admin\Documents\nm4v4nX6q8r69thUpH5Vd9Ga.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8892045.exe"C:\Users\Admin\AppData\Roaming\8892045.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3369564.exe"C:\Users\Admin\AppData\Roaming\3369564.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1488 -s 24328⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\aExdCfNXucfonbOOac2PuG9P.exe"C:\Users\Admin\Documents\aExdCfNXucfonbOOac2PuG9P.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\1JMmnCx5m4Z66yrXg1xiG_Zg.exe"C:\Users\Admin\Documents\1JMmnCx5m4Z66yrXg1xiG_Zg.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"7⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 10728⤵
- Program crash
- Enumerates system info in registry
-
C:\Users\Admin\Documents\2p7n8ODwQ7ewZod5XCq7_Pyh.exe"C:\Users\Admin\Documents\2p7n8ODwQ7ewZod5XCq7_Pyh.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\NVdmt6iXrXMJzlA2t58Tdg3O.exe"C:\Users\Admin\Documents\NVdmt6iXrXMJzlA2t58Tdg3O.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 2767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\SYQiuZH20mLYHs2aooMg596X.exe"C:\Users\Admin\Documents\SYQiuZH20mLYHs2aooMg596X.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 2807⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\S_E0CVI67McL3LWYzINfS7m4.exe"C:\Users\Admin\Documents\S_E0CVI67McL3LWYzINfS7m4.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-1G98S.tmp\S_E0CVI67McL3LWYzINfS7m4.tmp"C:\Users\Admin\AppData\Local\Temp\is-1G98S.tmp\S_E0CVI67McL3LWYzINfS7m4.tmp" /SL5="$20254,138429,56832,C:\Users\Admin\Documents\S_E0CVI67McL3LWYzINfS7m4.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-RDSNM.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-RDSNM.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 28010⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590693 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=7159⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590693 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6887135.exe"C:\Users\Admin\AppData\Roaming\6887135.exe"10⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5024 -s 232811⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\2289649.exe"C:\Users\Admin\AppData\Roaming\2289649.exe"10⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\6887761.exe"C:\Users\Admin\AppData\Roaming\6887761.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\8867950.exe"C:\Users\Admin\AppData\Roaming\8867950.exe"10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 253211⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"9⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-EN178.tmp\GameBoxWin32.tmp"C:\Users\Admin\AppData\Local\Temp\is-EN178.tmp\GameBoxWin32.tmp" /SL5="$20270,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590693 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"10⤵
-
C:\Users\Admin\Documents\vO2_yRX_ZljMrGdzV5L7u2tB.exe"C:\Users\Admin\Documents\vO2_yRX_ZljMrGdzV5L7u2tB.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1206345.exe"C:\Users\Admin\AppData\Roaming\1206345.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1108 -s 24408⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\5891405.exe"C:\Users\Admin\AppData\Roaming\5891405.exe"7⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 5764⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\pcaui.exeC:\Windows\System32\pcaui.exe -n 0 -a "" -v "" -g "" -x ""2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4100 -ip 41001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2528 -ip 25281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3608 -ip 36081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5072 -ip 50721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 672 -ip 6721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3196 -ip 31961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1188 -ip 11881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 460 -ip 4601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3188 -ip 31881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 740 -ip 7401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2016 -ip 20161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5020 -ip 50201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 4563⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 50E866EA6705FE7F33CCA191CA54163A C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 747F8F74F6DCA73A99AFC23C3823EA88 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5F8CDB0F9F947B867D7BF33D900307722⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5E7D85130AAA2DA43D1BD8E9DC834AB8 C2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=715 -BF=715 -uncf=default3⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--Kx45G9qPr"4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_A9FC.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites' -retry_count 10"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5548 -ip 55481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 640 -p 4396 -ip 43961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 1488 -ip 14881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 708 -p 1108 -ip 11081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\E768.exeC:\Users\Admin\AppData\Local\Temp\E768.exe1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5116 -ip 51161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 624 -p 5024 -ip 50241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\F0EE.exeC:\Users\Admin\AppData\Local\Temp\F0EE.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 2282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5536 -ip 55361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5212 -ip 52121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\F98A.exeC:\Users\Admin\AppData\Local\Temp\F98A.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 2362⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\FD06.exeC:\Users\Admin\AppData\Local\Temp\FD06.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\FD06.exeC:\Users\Admin\AppData\Local\Temp\FD06.exe2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\FD06.exe"3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\322.exeC:\Users\Admin\AppData\Local\Temp\322.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4260 -s 2802⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3268 -ip 32681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4260 -ip 42601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 8722⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1524 -ip 15241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_1.txtMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_2.exeMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_2.txtMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_3.exeMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_3.txtMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_4.exeMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_4.txtMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_5.exeMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_5.txtMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_6.exeMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\7zSC335A5A3\sonia_6.txtMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
99ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\Documents\1JMmnCx5m4Z66yrXg1xiG_Zg.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\1JMmnCx5m4Z66yrXg1xiG_Zg.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\2p7n8ODwQ7ewZod5XCq7_Pyh.exeMD5
ab8781ed006eff23e2f4391e9d87d33c
SHA1d557dc317e733bcc896a08158c4bc978b524c689
SHA2566543fb158c4d0ace63d292da67d86920914c57280adeb9726694cb7805f7466b
SHA51273c8f4b37d076e2d8606375d3bbc821ccaab5b82ba68e8b2aad48881dcb893ce218334cdaa026acc426080599794240157a6e56ceaa2979276e8e983dfc61a69
-
C:\Users\Admin\Documents\2p7n8ODwQ7ewZod5XCq7_Pyh.exeMD5
ab8781ed006eff23e2f4391e9d87d33c
SHA1d557dc317e733bcc896a08158c4bc978b524c689
SHA2566543fb158c4d0ace63d292da67d86920914c57280adeb9726694cb7805f7466b
SHA51273c8f4b37d076e2d8606375d3bbc821ccaab5b82ba68e8b2aad48881dcb893ce218334cdaa026acc426080599794240157a6e56ceaa2979276e8e983dfc61a69
-
C:\Users\Admin\Documents\HrIx13CSTMzqSnRS8QfzeiKD.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\HrIx13CSTMzqSnRS8QfzeiKD.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\Ki5oiMd0OUghu0IYj3jTOKQO.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\Ki5oiMd0OUghu0IYj3jTOKQO.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\NVdmt6iXrXMJzlA2t58Tdg3O.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
C:\Users\Admin\Documents\NVdmt6iXrXMJzlA2t58Tdg3O.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
C:\Users\Admin\Documents\SYQiuZH20mLYHs2aooMg596X.exeMD5
f550d370e8256649934a6c9052b0803c
SHA1cb7bc0a067bbbe77b306b87e2b4d3f0e9ce89175
SHA256175b0b3d82bc46f9178ca9051066496e464d846270f5abc7d2b5db01233efbc5
SHA512c19ef1e5d893ec8f53bdec76f6f6c23a712d53035c99cb2a9bef23899896d4be1a03378f512fce3c8fd87edbadc5f12fea8b1efbdec164dbd373632933f5b2b9
-
C:\Users\Admin\Documents\SYQiuZH20mLYHs2aooMg596X.exeMD5
f550d370e8256649934a6c9052b0803c
SHA1cb7bc0a067bbbe77b306b87e2b4d3f0e9ce89175
SHA256175b0b3d82bc46f9178ca9051066496e464d846270f5abc7d2b5db01233efbc5
SHA512c19ef1e5d893ec8f53bdec76f6f6c23a712d53035c99cb2a9bef23899896d4be1a03378f512fce3c8fd87edbadc5f12fea8b1efbdec164dbd373632933f5b2b9
-
C:\Users\Admin\Documents\SiJIi3_WqIkqQvI5QPMCmoGS.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\SiJIi3_WqIkqQvI5QPMCmoGS.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\UgLqpNcd72FQ5h4nmHT3P_Zo.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\UgLqpNcd72FQ5h4nmHT3P_Zo.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\X2_TPiNnV6_dYtMnZrxSY0hp.exeMD5
060e727c298a99826cabfacfee33321f
SHA1c94a1ab7b04f8f3bcba8538a901c7ae5f253c9aa
SHA256440fe79cbaf72137d3062df26751a1c8cf8b0e1ce56ad66d4fac66cf56cf6a02
SHA5126baddb62b3a6e592a2009c00029180a2eddb5e07773c900d0adbd29aeea2306586102493ecd18832b06254702a59be97933f38b78e8529d18e8e720896c30ef5
-
C:\Users\Admin\Documents\X5Gdy6gNFU_e8he4pTThuaQ7.exeMD5
47e86cc0cafdce94d5c05a5c9c5c388e
SHA1de4fcbdcc06a0d748a82666bfc1ec4e4a08e5be6
SHA2561d7d718be5b978fedd1124fa44831ba54af5bda0507f6eee05a0a8c8d9badda1
SHA512e8d4012ee736c1d256e03bd1756ebd5a0349c0b77903bf71ad80cf40ee3c586e32b1e1278bd54b6b58b58152a9382a4726b8242b98ac4665ba1d0ebecb50e47e
-
C:\Users\Admin\Documents\X5Gdy6gNFU_e8he4pTThuaQ7.exeMD5
47e86cc0cafdce94d5c05a5c9c5c388e
SHA1de4fcbdcc06a0d748a82666bfc1ec4e4a08e5be6
SHA2561d7d718be5b978fedd1124fa44831ba54af5bda0507f6eee05a0a8c8d9badda1
SHA512e8d4012ee736c1d256e03bd1756ebd5a0349c0b77903bf71ad80cf40ee3c586e32b1e1278bd54b6b58b58152a9382a4726b8242b98ac4665ba1d0ebecb50e47e
-
C:\Users\Admin\Documents\_Zc9whaKfl_JLWu6W0FAWmK1.exeMD5
f8d92d2f91fd134e57b6764c0eba5de3
SHA11ed71b2e5a398c1c1bc5f33cfe462d471a48fa52
SHA256420379eae2cab153a4f538c5c9b68d848e78d5c336c8e7e13a923913eb9ba32c
SHA51247d514492022932bb03f771d51bb1909235f9ebf7152b502e2412052628ff85c0342de42b4da8644c820b8bcf1e52fcace0fbc82c32c6216b4c2da56cf5eac71
-
C:\Users\Admin\Documents\aExdCfNXucfonbOOac2PuG9P.exeMD5
0f73a44e00e05a2257c26a0ab3eb84ab
SHA19c90dac9386f8ef2a44fac90f154a42173461a60
SHA256d256af9cf801950977e5c289587c7c9664d75d0d36e8b19c55e5e9b0ec0312a5
SHA512a3d479ad86ca6dd16298311f5244fc74e9c8711a8dc7bc45bb7f247e911e037f3258a353e2059538170b32800f9665593b7d4a3d7707770a7f79e5cc62bc0261
-
C:\Users\Admin\Documents\kRiLghXv_6ASLkGhyEhBWRyk.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\kRiLghXv_6ASLkGhyEhBWRyk.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\kRiLghXv_6ASLkGhyEhBWRyk.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\n89VBckFKsj9xfDOZqaqaA1P.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\n89VBckFKsj9xfDOZqaqaA1P.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\nm4v4nX6q8r69thUpH5Vd9Ga.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\nm4v4nX6q8r69thUpH5Vd9Ga.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\uJ9mYHAvuwIgAm_x05uSaMSM.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\uJ9mYHAvuwIgAm_x05uSaMSM.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
memory/460-327-0x0000000000A90000-0x0000000000ABF000-memory.dmpFilesize
188KB
-
memory/460-248-0x0000000000000000-mapping.dmp
-
memory/592-265-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/592-241-0x0000000000000000-mapping.dmp
-
memory/592-286-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/592-284-0x0000000000FF0000-0x0000000001005000-memory.dmpFilesize
84KB
-
memory/664-242-0x0000000000000000-mapping.dmp
-
memory/664-275-0x0000000000950000-0x0000000000960000-memory.dmpFilesize
64KB
-
memory/664-289-0x0000000000C80000-0x0000000000C92000-memory.dmpFilesize
72KB
-
memory/672-256-0x00000000049A0000-0x0000000004A3D000-memory.dmpFilesize
628KB
-
memory/672-212-0x0000000000000000-mapping.dmp
-
memory/740-232-0x0000000000000000-mapping.dmp
-
memory/740-399-0x0000000001510000-0x0000000001E36000-memory.dmpFilesize
9.1MB
-
memory/788-178-0x0000000000000000-mapping.dmp
-
memory/888-180-0x0000000000000000-mapping.dmp
-
memory/916-218-0x0000000000000000-mapping.dmp
-
memory/940-319-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/940-304-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/940-315-0x0000000005A80000-0x0000000005A81000-memory.dmpFilesize
4KB
-
memory/940-333-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/940-322-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/940-308-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/940-339-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/940-361-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/940-313-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/940-300-0x00000000031C0000-0x00000000031FC000-memory.dmpFilesize
240KB
-
memory/940-321-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/940-346-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/940-317-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/940-323-0x0000000005AD0000-0x0000000005AD1000-memory.dmpFilesize
4KB
-
memory/940-335-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/940-306-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/940-353-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/940-367-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/940-298-0x0000000000000000-mapping.dmp
-
memory/940-360-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/940-349-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/1068-294-0x0000000000000000-mapping.dmp
-
memory/1104-181-0x0000000000000000-mapping.dmp
-
memory/1108-387-0x0000000000000000-mapping.dmp
-
memory/1108-414-0x000000001BB90000-0x000000001BB92000-memory.dmpFilesize
8KB
-
memory/1188-247-0x0000000000000000-mapping.dmp
-
memory/1188-282-0x0000000002D80000-0x0000000002D89000-memory.dmpFilesize
36KB
-
memory/1200-183-0x0000000000000000-mapping.dmp
-
memory/1292-288-0x0000000000000000-mapping.dmp
-
memory/1292-296-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1388-431-0x0000000000000000-mapping.dmp
-
memory/1488-369-0x00000000010E0000-0x0000000001114000-memory.dmpFilesize
208KB
-
memory/1488-329-0x0000000000000000-mapping.dmp
-
memory/1488-359-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/1488-365-0x000000001B910000-0x000000001B912000-memory.dmpFilesize
8KB
-
memory/1488-337-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/1516-182-0x0000000000000000-mapping.dmp
-
memory/1632-401-0x0000000000000000-mapping.dmp
-
memory/1708-287-0x0000000000000000-mapping.dmp
-
memory/1824-482-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB
-
memory/1952-381-0x0000000000000000-mapping.dmp
-
memory/1956-403-0x0000000000000000-mapping.dmp
-
memory/1992-390-0x0000000000000000-mapping.dmp
-
memory/1992-484-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/2012-341-0x0000000000000000-mapping.dmp
-
memory/2012-441-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2016-409-0x0000000004A80000-0x0000000004B13000-memory.dmpFilesize
588KB
-
memory/2016-394-0x0000000000000000-mapping.dmp
-
memory/2084-523-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/2088-184-0x0000000000000000-mapping.dmp
-
memory/2284-357-0x0000000000000000-mapping.dmp
-
memory/2284-363-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/2528-186-0x0000000000000000-mapping.dmp
-
memory/2528-205-0x0000000000A30000-0x0000000000A39000-memory.dmpFilesize
36KB
-
memory/2544-243-0x0000000000000000-mapping.dmp
-
memory/2544-351-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/2544-316-0x0000000005A40000-0x0000000005A41000-memory.dmpFilesize
4KB
-
memory/2544-314-0x0000000006160000-0x0000000006161000-memory.dmpFilesize
4KB
-
memory/2544-305-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/2544-362-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/2544-328-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/2544-324-0x0000000005C40000-0x0000000005C41000-memory.dmpFilesize
4KB
-
memory/2560-185-0x0000000000000000-mapping.dmp
-
memory/2712-492-0x0000022D1ECD0000-0x0000022D1EE02000-memory.dmpFilesize
1.2MB
-
memory/2712-491-0x0000022D1EAD0000-0x0000022D1EB9D000-memory.dmpFilesize
820KB
-
memory/2712-407-0x0000000000000000-mapping.dmp
-
memory/3020-518-0x0000027471940000-0x00000274719AE000-memory.dmpFilesize
440KB
-
memory/3020-290-0x0000000000000000-mapping.dmp
-
memory/3020-522-0x00000274719B0000-0x0000027471A7F000-memory.dmpFilesize
828KB
-
memory/3036-213-0x0000000000000000-mapping.dmp
-
memory/3036-285-0x0000000005980000-0x0000000005F26000-memory.dmpFilesize
5.6MB
-
memory/3036-245-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/3036-297-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/3188-299-0x0000000000400000-0x000000000067D000-memory.dmpFilesize
2.5MB
-
memory/3188-293-0x0000000000000000-mapping.dmp
-
memory/3196-280-0x00000000049C0000-0x0000000004A5D000-memory.dmpFilesize
628KB
-
memory/3196-246-0x0000000000000000-mapping.dmp
-
memory/3200-429-0x0000000000000000-mapping.dmp
-
memory/3200-443-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3200-179-0x0000000000000000-mapping.dmp
-
memory/3208-310-0x0000000002FC0000-0x0000000002FD6000-memory.dmpFilesize
88KB
-
memory/3244-352-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/3244-342-0x0000000000000000-mapping.dmp
-
memory/3244-368-0x0000000002650000-0x0000000002657000-memory.dmpFilesize
28KB
-
memory/3376-331-0x000000001BBB0000-0x000000001BBB2000-memory.dmpFilesize
8KB
-
memory/3376-311-0x0000000000000000-mapping.dmp
-
memory/3416-344-0x0000000000000000-mapping.dmp
-
memory/3572-292-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/3572-244-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/3572-266-0x00000000059C0000-0x0000000005F66000-memory.dmpFilesize
5.6MB
-
memory/3572-274-0x00000000059C0000-0x00000000059C1000-memory.dmpFilesize
4KB
-
memory/3572-214-0x0000000000000000-mapping.dmp
-
memory/3572-278-0x0000000006520000-0x0000000006521000-memory.dmpFilesize
4KB
-
memory/3572-233-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/3572-240-0x0000000005F70000-0x0000000005F71000-memory.dmpFilesize
4KB
-
memory/3592-418-0x0000000000000000-mapping.dmp
-
memory/3608-190-0x0000000000000000-mapping.dmp
-
memory/3608-206-0x0000000000AD0000-0x0000000000B6D000-memory.dmpFilesize
628KB
-
memory/3616-196-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/3616-189-0x0000000000000000-mapping.dmp
-
memory/3616-201-0x000000001B470000-0x000000001B472000-memory.dmpFilesize
8KB
-
memory/3656-267-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3656-258-0x0000000000000000-mapping.dmp
-
memory/3736-397-0x0000000000000000-mapping.dmp
-
memory/3784-202-0x0000000000000000-mapping.dmp
-
memory/3852-199-0x0000000000000000-mapping.dmp
-
memory/3864-216-0x0000000000000000-mapping.dmp
-
memory/3864-283-0x0000000000A80000-0x0000000000A82000-memory.dmpFilesize
8KB
-
memory/3864-405-0x0000000000000000-mapping.dmp
-
memory/3864-277-0x0000000002350000-0x0000000002365000-memory.dmpFilesize
84KB
-
memory/3864-234-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/3864-464-0x000000001B170000-0x000000001B172000-memory.dmpFilesize
8KB
-
memory/3904-445-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/3904-354-0x0000000000000000-mapping.dmp
-
memory/4100-170-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4100-171-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/4100-165-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4100-151-0x0000000000000000-mapping.dmp
-
memory/4100-168-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4100-164-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4100-167-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4100-169-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4100-166-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4336-460-0x0000000002100000-0x0000000002101000-memory.dmpFilesize
4KB
-
memory/4396-366-0x000000001BA80000-0x000000001BA81000-memory.dmpFilesize
4KB
-
memory/4396-370-0x000000001C180000-0x000000001C181000-memory.dmpFilesize
4KB
-
memory/4396-358-0x00000000029F0000-0x0000000002A1B000-memory.dmpFilesize
172KB
-
memory/4396-340-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB
-
memory/4396-332-0x0000000000000000-mapping.dmp
-
memory/4396-377-0x000000001B6A0000-0x000000001B6A2000-memory.dmpFilesize
8KB
-
memory/4464-272-0x0000000004940000-0x000000000494A000-memory.dmpFilesize
40KB
-
memory/4464-217-0x0000000000000000-mapping.dmp
-
memory/4584-254-0x0000000000000000-mapping.dmp
-
memory/4704-149-0x0000000000000000-mapping.dmp
-
memory/4868-412-0x0000000000000000-mapping.dmp
-
memory/4924-146-0x0000000000000000-mapping.dmp
-
memory/5024-514-0x0000000002F10000-0x0000000002F12000-memory.dmpFilesize
8KB
-
memory/5052-191-0x0000000000000000-mapping.dmp
-
memory/5072-208-0x0000000000000000-mapping.dmp
-
memory/5072-309-0x0000000001000000-0x0000000001001000-memory.dmpFilesize
4KB
-
memory/5072-237-0x0000000000000000-mapping.dmp
-
memory/5072-356-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/5092-301-0x000001CDF0A20000-0x000001CDF0A8F000-memory.dmpFilesize
444KB
-
memory/5092-215-0x0000000000000000-mapping.dmp
-
memory/5092-302-0x000001CDF0A90000-0x000001CDF0B5F000-memory.dmpFilesize
828KB
-
memory/5104-192-0x0000000000000000-mapping.dmp
-
memory/5116-364-0x0000000000000000-mapping.dmp
-
memory/5116-378-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/5212-512-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB