Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
386s -
max time network
924s -
platform
windows11_x64 -
resource
win11 -
submitted
13-08-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
8 (3).exe
Resource
win11
Behavioral task
behavioral2
Sample
8 (30).exe
Resource
win11
Behavioral task
behavioral3
Sample
8 (31).exe
Resource
win11
Errors
General
-
Target
8 (4).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/5300-437-0x00000000016C0000-0x0000000001FE6000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXerUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4032 4816 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5976 4816 rUNdlL32.eXe -
Raccoon Stealer Payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/4160-451-0x0000000004890000-0x0000000004923000-memory.dmp family_raccoon behavioral4/memory/4828-504-0x0000000005130000-0x0000000005748000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\ezTQ8CM6JbC6ER4SHNsPg1zd.exe family_redline C:\Users\Admin\Documents\DBAyf2zrlAo1c_2A5SJZjVeL.exe family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 17 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 4492 created 4656 4492 WerFault.exe setup_install.exe PID 3184 created 3492 3184 WerFault.exe sonia_2.exe PID 5020 created 3744 5020 WerFault.exe god7mdfnF5Hnj_XIiFbABBUg.exe PID 3032 created 4600 3032 WerFault.exe rundll32.exe PID 5556 created 5160 5556 WerFault.exe 5yUPJBDPvl3fT0Gl5djpika6.exe PID 5688 created 5184 5688 WerFault.exe Qzak0bYOl0HYykP9CNoT0QGa.exe PID 5776 created 4236 5776 WerFault.exe V4YrPI8QpGX9Ucokzw4oW8fP.exe PID 1336 created 5172 1336 WerFault.exe A5oXGGRIWoEPa64uoj0Sne_X.exe PID 1244 created 5300 1244 WerFault.exe WpluEqYqtl60fUrXodfxKZKw.exe PID 1336 created 4160 1336 WerFault.exe GameBox64bit.exe PID 2688 created 3404 2688 WerFault.exe rundll32.exe PID 5472 created 2492 5472 WerFault.exe 5872873.exe PID 5900 created 1420 5900 WerFault.exe 2557933.exe PID 4032 created 4480 4032 WerFault.exe 1022245.exe PID 6336 created 5560 6336 WerFault.exe 7216578.exe PID 6880 created 3300 6880 WerFault.exe 3536827.exe PID 6944 created 5048 6944 WerFault.exe 8082108.exe -
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral4/memory/3744-206-0x0000000000BB0000-0x0000000000C4D000-memory.dmp family_vidar behavioral4/memory/5184-268-0x00000000049C0000-0x0000000004A5D000-memory.dmp family_vidar behavioral4/memory/4236-272-0x0000000004A20000-0x0000000004ABD000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurlpp.dll aspack_v212_v242 -
Blocklisted process makes network request 10 IoCs
Processes:
MsiExec.exepowershell.exeflow pid process 162 6980 MsiExec.exe 163 6980 MsiExec.exe 165 6980 MsiExec.exe 166 6980 MsiExec.exe 167 6980 MsiExec.exe 170 6980 MsiExec.exe 174 6980 MsiExec.exe 175 6980 MsiExec.exe 193 1628 powershell.exe 194 1628 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
j1tdMXakQkoMjZWj5pICYBq1.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts j1tdMXakQkoMjZWj5pICYBq1.exe -
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exesonia_4.exesonia_5.exeWerFault.exesonia_2.exesonia_6.exesonia_3.exesonia_1.exeWerFault.exeKcM_aXJkNcTcljKDf8gG11wo.exegod7mdfnF5Hnj_XIiFbABBUg.exeV4YrPI8QpGX9Ucokzw4oW8fP.exeCExPm2teptKJM3U3nqqgCPm0.exeobOYO9tzCg15blk8m_371Z_K.exeDBAyf2zrlAo1c_2A5SJZjVeL.exe5yUPJBDPvl3fT0Gl5djpika6.exeA5oXGGRIWoEPa64uoj0Sne_X.exeQzak0bYOl0HYykP9CNoT0QGa.exeqdeiSzvFWIvFVz6SZp4bDwDR.exeezTQ8CM6JbC6ER4SHNsPg1zd.exebkQZw1gCVF9krsiOQVj1lfKN.exej1tdMXakQkoMjZWj5pICYBq1.exeSG_ecBNA0JiSzLp3dJc4h3im.exeWpluEqYqtl60fUrXodfxKZKw.exeBqqjQitAqMx10VLZYGXnOVUv.exeTL72W7u8qebE9iUtdhAHthYF.exeCExPm2teptKJM3U3nqqgCPm0.execustomer3.exemd8_8eus.exejooyu.exeJtS4xX5pg56xxh_LNk0OMRUm.exejfiag3g_gg.exeJtS4xX5pg56xxh_LNk0OMRUm.tmp5872873.exe1022245.exejfiag3g_gg.exe8272398.exe2557933.exe7129630.exe2113434.exe7103215.exe7216578.exe11111.exe11111.exeSetup.exe11111.exe11111.exeGameBox64bit.exeGameBoxWin64.exeWeather Installation.exeGameBox.exeGameBox32Bit.exeWerFault.exenote8876.exeGameBoxWin32.exeWinHoster.exeCleaner Installation.exe11111.exeGameBoxWin32.tmp11111.exe8108524.exeKcM_aXJkNcTcljKDf8gG11wo.exejfiag3g_gg.exepid process 4292 setup_installer.exe 4656 setup_install.exe 3932 sonia_4.exe 4256 sonia_5.exe 4348 WerFault.exe 3492 sonia_2.exe 512 sonia_6.exe 3744 sonia_3.exe 3940 sonia_1.exe 5020 WerFault.exe 3184 KcM_aXJkNcTcljKDf8gG11wo.exe 3744 god7mdfnF5Hnj_XIiFbABBUg.exe 4236 V4YrPI8QpGX9Ucokzw4oW8fP.exe 4700 CExPm2teptKJM3U3nqqgCPm0.exe 5148 obOYO9tzCg15blk8m_371Z_K.exe 5132 DBAyf2zrlAo1c_2A5SJZjVeL.exe 5160 5yUPJBDPvl3fT0Gl5djpika6.exe 5172 A5oXGGRIWoEPa64uoj0Sne_X.exe 5184 Qzak0bYOl0HYykP9CNoT0QGa.exe 5196 qdeiSzvFWIvFVz6SZp4bDwDR.exe 5208 ezTQ8CM6JbC6ER4SHNsPg1zd.exe 5240 bkQZw1gCVF9krsiOQVj1lfKN.exe 5256 j1tdMXakQkoMjZWj5pICYBq1.exe 5276 SG_ecBNA0JiSzLp3dJc4h3im.exe 5300 WpluEqYqtl60fUrXodfxKZKw.exe 5324 BqqjQitAqMx10VLZYGXnOVUv.exe 5360 TL72W7u8qebE9iUtdhAHthYF.exe 5704 CExPm2teptKJM3U3nqqgCPm0.exe 6036 customer3.exe 6088 md8_8eus.exe 6132 jooyu.exe 5232 JtS4xX5pg56xxh_LNk0OMRUm.exe 1392 jfiag3g_gg.exe 5316 JtS4xX5pg56xxh_LNk0OMRUm.tmp 2492 5872873.exe 4480 1022245.exe 4400 jfiag3g_gg.exe 2752 8272398.exe 1420 2557933.exe 1460 7129630.exe 2000 2113434.exe 4608 7103215.exe 5560 7216578.exe 5644 11111.exe 6140 11111.exe 3312 Setup.exe 3988 11111.exe 1936 11111.exe 4160 GameBox64bit.exe 4856 GameBoxWin64.exe 5664 Weather Installation.exe 5632 GameBox.exe 3092 GameBox32Bit.exe 2688 WerFault.exe 5244 note8876.exe 3084 GameBoxWin32.exe 2816 WinHoster.exe 3896 Cleaner Installation.exe 5468 11111.exe 5288 GameBoxWin32.tmp 5460 11111.exe 1332 8108524.exe 4828 KcM_aXJkNcTcljKDf8gG11wo.exe 5844 jfiag3g_gg.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule behavioral4/memory/6088-299-0x0000000000400000-0x000000000067D000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ezTQ8CM6JbC6ER4SHNsPg1zd.exeSG_ecBNA0JiSzLp3dJc4h3im.exeDBAyf2zrlAo1c_2A5SJZjVeL.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ezTQ8CM6JbC6ER4SHNsPg1zd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ezTQ8CM6JbC6ER4SHNsPg1zd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SG_ecBNA0JiSzLp3dJc4h3im.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SG_ecBNA0JiSzLp3dJc4h3im.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DBAyf2zrlAo1c_2A5SJZjVeL.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DBAyf2zrlAo1c_2A5SJZjVeL.exe -
Drops startup file 2 IoCs
Processes:
customer3.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe -
Loads dropped DLL 64 IoCs
Processes:
setup_install.exerundll32.exeJtS4xX5pg56xxh_LNk0OMRUm.tmpGameBoxWin64.exeWeather Installation.exeCleaner Installation.exeGameBoxWin32.tmprundll32.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeCleaner_Installation.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exepid process 4656 setup_install.exe 4656 setup_install.exe 4656 setup_install.exe 4656 setup_install.exe 4656 setup_install.exe 4600 rundll32.exe 5316 JtS4xX5pg56xxh_LNk0OMRUm.tmp 5316 JtS4xX5pg56xxh_LNk0OMRUm.tmp 4856 GameBoxWin64.exe 4856 GameBoxWin64.exe 5664 Weather Installation.exe 3896 Cleaner Installation.exe 5288 GameBoxWin32.tmp 4856 GameBoxWin64.exe 3404 rundll32.exe 3924 MsiExec.exe 3924 MsiExec.exe 3048 MsiExec.exe 5248 MsiExec.exe 3048 MsiExec.exe 5248 MsiExec.exe 5248 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 6980 MsiExec.exe 5716 Cleaner_Installation.exe 5716 Cleaner_Installation.exe 5716 Cleaner_Installation.exe 5716 Cleaner_Installation.exe 3496 Cleaner.exe 5716 Cleaner_Installation.exe 5716 Cleaner_Installation.exe 3496 Cleaner.exe 3496 Cleaner.exe 4512 Cleaner.exe 5536 Cleaner.exe 5536 Cleaner.exe 5536 Cleaner.exe 6680 Cleaner.exe 5500 Cleaner.exe 6680 Cleaner.exe 6680 Cleaner.exe 5500 Cleaner.exe 5500 Cleaner.exe 5536 Cleaner.exe 5592 Cleaner.exe 5592 Cleaner.exe 5592 Cleaner.exe 5592 Cleaner.exe 6472 Cleaner.exe 6472 Cleaner.exe 6472 Cleaner.exe 6472 Cleaner.exe 3864 Cleaner.exe 3864 Cleaner.exe 3864 Cleaner.exe 3864 Cleaner.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\ezTQ8CM6JbC6ER4SHNsPg1zd.exe themida C:\Users\Admin\Documents\DBAyf2zrlAo1c_2A5SJZjVeL.exe themida C:\Users\Admin\Documents\SG_ecBNA0JiSzLp3dJc4h3im.exe themida behavioral4/memory/5208-309-0x0000000000620000-0x0000000000621000-memory.dmp themida behavioral4/memory/5132-313-0x00000000005C0000-0x00000000005C1000-memory.dmp themida behavioral4/memory/5276-305-0x0000000000730000-0x0000000000731000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
sonia_6.exe8272398.exeaipackagechainer.exeCleaner_Installation.exemsedge.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 8272398.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Cleaner_Installation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cleaner = "C:\\Users\\Admin\\AppData\\Roaming\\Cleaner\\Cleaner.exe --anbfs" Cleaner_Installation.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5" msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
SG_ecBNA0JiSzLp3dJc4h3im.exeezTQ8CM6JbC6ER4SHNsPg1zd.exeDBAyf2zrlAo1c_2A5SJZjVeL.exemd8_8eus.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SG_ecBNA0JiSzLp3dJc4h3im.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ezTQ8CM6JbC6ER4SHNsPg1zd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DBAyf2zrlAo1c_2A5SJZjVeL.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Cleaner Installation.exeWeather Installation.exeGameBoxWin64.exemsiexec.exedescription ioc process File opened (read-only) \??\E: Cleaner Installation.exe File opened (read-only) \??\S: Weather Installation.exe File opened (read-only) \??\F: GameBoxWin64.exe File opened (read-only) \??\G: GameBoxWin64.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: Cleaner Installation.exe File opened (read-only) \??\K: GameBoxWin64.exe File opened (read-only) \??\N: GameBoxWin64.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: Cleaner Installation.exe File opened (read-only) \??\J: Weather Installation.exe File opened (read-only) \??\T: Weather Installation.exe File opened (read-only) \??\U: Weather Installation.exe File opened (read-only) \??\Y: GameBoxWin64.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: Cleaner Installation.exe File opened (read-only) \??\W: Cleaner Installation.exe File opened (read-only) \??\F: Weather Installation.exe File opened (read-only) \??\I: Weather Installation.exe File opened (read-only) \??\M: Weather Installation.exe File opened (read-only) \??\Q: Weather Installation.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\J: Cleaner Installation.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: Cleaner Installation.exe File opened (read-only) \??\N: Cleaner Installation.exe File opened (read-only) \??\W: Weather Installation.exe File opened (read-only) \??\X: Weather Installation.exe File opened (read-only) \??\E: GameBoxWin64.exe File opened (read-only) \??\H: GameBoxWin64.exe File opened (read-only) \??\L: GameBoxWin64.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\O: Cleaner Installation.exe File opened (read-only) \??\Q: Cleaner Installation.exe File opened (read-only) \??\Z: Cleaner Installation.exe File opened (read-only) \??\A: Weather Installation.exe File opened (read-only) \??\J: GameBoxWin64.exe File opened (read-only) \??\U: GameBoxWin64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: Weather Installation.exe File opened (read-only) \??\V: Weather Installation.exe File opened (read-only) \??\X: GameBoxWin64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: Cleaner Installation.exe File opened (read-only) \??\I: GameBoxWin64.exe File opened (read-only) \??\O: GameBoxWin64.exe File opened (read-only) \??\Q: GameBoxWin64.exe File opened (read-only) \??\M: Cleaner Installation.exe File opened (read-only) \??\G: Weather Installation.exe File opened (read-only) \??\K: Weather Installation.exe File opened (read-only) \??\O: Weather Installation.exe File opened (read-only) \??\A: GameBoxWin64.exe File opened (read-only) \??\F: Cleaner Installation.exe File opened (read-only) \??\K: Cleaner Installation.exe File opened (read-only) \??\V: Cleaner Installation.exe File opened (read-only) \??\V: GameBoxWin64.exe File opened (read-only) \??\W: GameBoxWin64.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: Weather Installation.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ipinfo.io 3 ip-api.com 13 ipinfo.io 94 ipinfo.io -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
SG_ecBNA0JiSzLp3dJc4h3im.exeezTQ8CM6JbC6ER4SHNsPg1zd.exeDBAyf2zrlAo1c_2A5SJZjVeL.exepid process 5276 SG_ecBNA0JiSzLp3dJc4h3im.exe 5208 ezTQ8CM6JbC6ER4SHNsPg1zd.exe 5132 DBAyf2zrlAo1c_2A5SJZjVeL.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
CExPm2teptKJM3U3nqqgCPm0.exeKcM_aXJkNcTcljKDf8gG11wo.exej1tdMXakQkoMjZWj5pICYBq1.exedescription pid process target process PID 4700 set thread context of 5704 4700 CExPm2teptKJM3U3nqqgCPm0.exe CExPm2teptKJM3U3nqqgCPm0.exe PID 3184 set thread context of 4828 3184 KcM_aXJkNcTcljKDf8gG11wo.exe KcM_aXJkNcTcljKDf8gG11wo.exe PID 5256 set thread context of 4168 5256 j1tdMXakQkoMjZWj5pICYBq1.exe j1tdMXakQkoMjZWj5pICYBq1.exe -
Drops file in Program Files directory 23 IoCs
Processes:
bkQZw1gCVF9krsiOQVj1lfKN.exeSetup.exemd8_8eus.exej1tdMXakQkoMjZWj5pICYBq1.exedescription ioc process File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini bkQZw1gCVF9krsiOQVj1lfKN.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe Setup.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW md8_8eus.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe bkQZw1gCVF9krsiOQVj1lfKN.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe bkQZw1gCVF9krsiOQVj1lfKN.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe bkQZw1gCVF9krsiOQVj1lfKN.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe bkQZw1gCVF9krsiOQVj1lfKN.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\resources.pak j1tdMXakQkoMjZWj5pICYBq1.exe -
Drops file in Windows directory 26 IoCs
Processes:
msiexec.exesvchost.exeWerFault.exedescription ioc process File opened for modification C:\Windows\Installer\MSIF351.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIF617.tmp msiexec.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst svchost.exe File opened for modification C:\Windows\Installer\MSI5223.tmp msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File created C:\Windows\Installer\f74e6ac.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF43D.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF12D6AAE46563A1AD.TMP msiexec.exe File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\Installer\MSIF7BE.tmp msiexec.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.override svchost.exe File created C:\Windows\SystemTemp\~DF54CC8B71C908B8D9.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIEDA2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF41D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF52B.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFB6D151B8D04AE90E.TMP msiexec.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp svchost.exe File created C:\Windows\SystemTemp\~DFAF34EF2FDE2B76D2.TMP msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIF330.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF4DB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIF51B.tmp msiexec.exe File opened for modification C:\Windows\Installer\f74e6ac.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF45D.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 17 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3560 4656 WerFault.exe setup_install.exe 4348 3492 WerFault.exe sonia_2.exe 3184 3744 WerFault.exe sonia_3.exe 3620 4600 WerFault.exe rundll32.exe 5756 5160 WerFault.exe 5yUPJBDPvl3fT0Gl5djpika6.exe 6052 4236 WerFault.exe V4YrPI8QpGX9Ucokzw4oW8fP.exe 5932 5184 WerFault.exe Qzak0bYOl0HYykP9CNoT0QGa.exe 5036 5172 WerFault.exe A5oXGGRIWoEPa64uoj0Sne_X.exe 6048 4160 WerFault.exe GameBox64bit.exe 3080 5300 WerFault.exe WpluEqYqtl60fUrXodfxKZKw.exe 5348 3404 WerFault.exe rundll32.exe 5840 2492 WerFault.exe 5872873.exe 3792 1420 WerFault.exe 2557933.exe 6264 4480 WerFault.exe 1022245.exe 6412 5560 WerFault.exe 7216578.exe 6928 3300 WerFault.exe 3536827.exe 5576 5048 WerFault.exe 8082108.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
CExPm2teptKJM3U3nqqgCPm0.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CExPm2teptKJM3U3nqqgCPm0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CExPm2teptKJM3U3nqqgCPm0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CExPm2teptKJM3U3nqqgCPm0.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeKcM_aXJkNcTcljKDf8gG11wo.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeMoNotificationUx.exeMoNotificationUx.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz KcM_aXJkNcTcljKDf8gG11wo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier KcM_aXJkNcTcljKDf8gG11wo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier KcM_aXJkNcTcljKDf8gG11wo.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MoNotificationUx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MoNotificationUx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 KcM_aXJkNcTcljKDf8gG11wo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MoNotificationUx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 37 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exemsedge.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeKcM_aXJkNcTcljKDf8gG11wo.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU KcM_aXJkNcTcljKDf8gG11wo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS KcM_aXJkNcTcljKDf8gG11wo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 5732 taskkill.exe 560 taskkill.exe -
Modifies data under HKEY_USERS 11 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordLength = "8" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordCharacterGroups = "2" svchost.exe -
Modifies registry class 2 IoCs
Processes:
Cleaner.exeCleaner.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{391DE9F0-3195-49D7-84E8-7FD8A126E045} Cleaner.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{8CCAAA35-37C1-4C7C-9D12-0C7AB8E9030A} Cleaner.exe -
Processes:
Cleaner Installation.exeWeather Installation.exeGameBoxWin64.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b55c0000000100000004000000001000002000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Weather Installation.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B Weather Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Set value (data) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 Weather Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Weather Installation.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 92 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 97 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeKcM_aXJkNcTcljKDf8gG11wo.exeWerFault.exeCExPm2teptKJM3U3nqqgCPm0.exeWerFault.exeWerFault.exeWerFault.exejfiag3g_gg.exeWerFault.exeWerFault.exeWerFault.exejfiag3g_gg.exeezTQ8CM6JbC6ER4SHNsPg1zd.exeWerFault.exeMsiExec.exe5872873.exe7216578.exe2557933.exe1022245.exeDBAyf2zrlAo1c_2A5SJZjVeL.exeWerFault.exeWerFault.exeWerFault.exeSG_ecBNA0JiSzLp3dJc4h3im.exeWerFault.exe3536827.exeWerFault.exe8082108.exeKcM_aXJkNcTcljKDf8gG11wo.exemsiexec.exepid process 3560 WerFault.exe 3560 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 3184 KcM_aXJkNcTcljKDf8gG11wo.exe 3184 KcM_aXJkNcTcljKDf8gG11wo.exe 3620 WerFault.exe 3620 WerFault.exe 5704 CExPm2teptKJM3U3nqqgCPm0.exe 5704 CExPm2teptKJM3U3nqqgCPm0.exe 5756 WerFault.exe 5756 WerFault.exe 6052 WerFault.exe 5932 WerFault.exe 5932 WerFault.exe 6052 WerFault.exe 1392 jfiag3g_gg.exe 1392 jfiag3g_gg.exe 5036 WerFault.exe 5036 WerFault.exe 3080 WerFault.exe 3080 WerFault.exe 6048 WerFault.exe 6048 WerFault.exe 5844 jfiag3g_gg.exe 5844 jfiag3g_gg.exe 5208 ezTQ8CM6JbC6ER4SHNsPg1zd.exe 5208 ezTQ8CM6JbC6ER4SHNsPg1zd.exe 5348 WerFault.exe 5348 WerFault.exe 3924 MsiExec.exe 3924 MsiExec.exe 2492 5872873.exe 2492 5872873.exe 5560 7216578.exe 5560 7216578.exe 1420 2557933.exe 1420 2557933.exe 4480 1022245.exe 4480 1022245.exe 5132 DBAyf2zrlAo1c_2A5SJZjVeL.exe 5132 DBAyf2zrlAo1c_2A5SJZjVeL.exe 5840 WerFault.exe 5840 WerFault.exe 3792 WerFault.exe 3792 WerFault.exe 5208 ezTQ8CM6JbC6ER4SHNsPg1zd.exe 6264 WerFault.exe 6264 WerFault.exe 5276 SG_ecBNA0JiSzLp3dJc4h3im.exe 5276 SG_ecBNA0JiSzLp3dJc4h3im.exe 6412 WerFault.exe 6412 WerFault.exe 5132 DBAyf2zrlAo1c_2A5SJZjVeL.exe 3300 3536827.exe 3300 3536827.exe 6928 WerFault.exe 6928 WerFault.exe 5048 8082108.exe 5048 8082108.exe 4828 KcM_aXJkNcTcljKDf8gG11wo.exe 4828 KcM_aXJkNcTcljKDf8gG11wo.exe 5916 msiexec.exe 5916 msiexec.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
8108524.exepid process 1332 8108524.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exesonia_4.exeWerFault.exeqdeiSzvFWIvFVz6SZp4bDwDR.exeTL72W7u8qebE9iUtdhAHthYF.exeBqqjQitAqMx10VLZYGXnOVUv.exe5872873.exe7216578.exeDBAyf2zrlAo1c_2A5SJZjVeL.exeSG_ecBNA0JiSzLp3dJc4h3im.exeezTQ8CM6JbC6ER4SHNsPg1zd.exe2557933.exe1022245.exe2113434.exeGameBox.exeKcM_aXJkNcTcljKDf8gG11wo.exe7129630.exe7103215.exeKcM_aXJkNcTcljKDf8gG11wo.exemsiexec.exeGameBoxWin64.exe3536827.exe8082108.exedescription pid process Token: SeSystemEnvironmentPrivilege 4972 svchost.exe Token: SeDebugPrivilege 3932 sonia_4.exe Token: SeRestorePrivilege 3560 WerFault.exe Token: SeBackupPrivilege 3560 WerFault.exe Token: SeBackupPrivilege 3560 WerFault.exe Token: SeDebugPrivilege 5196 qdeiSzvFWIvFVz6SZp4bDwDR.exe Token: SeDebugPrivilege 5360 TL72W7u8qebE9iUtdhAHthYF.exe Token: SeDebugPrivilege 5324 BqqjQitAqMx10VLZYGXnOVUv.exe Token: SeDebugPrivilege 2492 5872873.exe Token: SeDebugPrivilege 5560 7216578.exe Token: SeDebugPrivilege 5132 DBAyf2zrlAo1c_2A5SJZjVeL.exe Token: SeDebugPrivilege 5276 SG_ecBNA0JiSzLp3dJc4h3im.exe Token: SeDebugPrivilege 5208 ezTQ8CM6JbC6ER4SHNsPg1zd.exe Token: SeDebugPrivilege 1420 2557933.exe Token: SeDebugPrivilege 4480 1022245.exe Token: SeDebugPrivilege 2000 2113434.exe Token: SeDebugPrivilege 5632 GameBox.exe Token: SeDebugPrivilege 3184 KcM_aXJkNcTcljKDf8gG11wo.exe Token: SeDebugPrivilege 1460 7129630.exe Token: SeDebugPrivilege 4608 7103215.exe Token: SeDebugPrivilege 4828 KcM_aXJkNcTcljKDf8gG11wo.exe Token: SeSecurityPrivilege 5916 msiexec.exe Token: SeCreateTokenPrivilege 4856 GameBoxWin64.exe Token: SeAssignPrimaryTokenPrivilege 4856 GameBoxWin64.exe Token: SeLockMemoryPrivilege 4856 GameBoxWin64.exe Token: SeIncreaseQuotaPrivilege 4856 GameBoxWin64.exe Token: SeMachineAccountPrivilege 4856 GameBoxWin64.exe Token: SeTcbPrivilege 4856 GameBoxWin64.exe Token: SeSecurityPrivilege 4856 GameBoxWin64.exe Token: SeTakeOwnershipPrivilege 4856 GameBoxWin64.exe Token: SeLoadDriverPrivilege 4856 GameBoxWin64.exe Token: SeSystemProfilePrivilege 4856 GameBoxWin64.exe Token: SeSystemtimePrivilege 4856 GameBoxWin64.exe Token: SeProfSingleProcessPrivilege 4856 GameBoxWin64.exe Token: SeIncBasePriorityPrivilege 4856 GameBoxWin64.exe Token: SeCreatePagefilePrivilege 4856 GameBoxWin64.exe Token: SeCreatePermanentPrivilege 4856 GameBoxWin64.exe Token: SeBackupPrivilege 4856 GameBoxWin64.exe Token: SeRestorePrivilege 4856 GameBoxWin64.exe Token: SeShutdownPrivilege 4856 GameBoxWin64.exe Token: SeDebugPrivilege 4856 GameBoxWin64.exe Token: SeAuditPrivilege 4856 GameBoxWin64.exe Token: SeSystemEnvironmentPrivilege 4856 GameBoxWin64.exe Token: SeChangeNotifyPrivilege 4856 GameBoxWin64.exe Token: SeRemoteShutdownPrivilege 4856 GameBoxWin64.exe Token: SeUndockPrivilege 4856 GameBoxWin64.exe Token: SeSyncAgentPrivilege 4856 GameBoxWin64.exe Token: SeEnableDelegationPrivilege 4856 GameBoxWin64.exe Token: SeManageVolumePrivilege 4856 GameBoxWin64.exe Token: SeImpersonatePrivilege 4856 GameBoxWin64.exe Token: SeCreateGlobalPrivilege 4856 GameBoxWin64.exe Token: SeDebugPrivilege 3300 3536827.exe Token: SeDebugPrivilege 5048 8082108.exe Token: SeCreateTokenPrivilege 4856 GameBoxWin64.exe Token: SeAssignPrimaryTokenPrivilege 4856 GameBoxWin64.exe Token: SeLockMemoryPrivilege 4856 GameBoxWin64.exe Token: SeIncreaseQuotaPrivilege 4856 GameBoxWin64.exe Token: SeMachineAccountPrivilege 4856 GameBoxWin64.exe Token: SeTcbPrivilege 4856 GameBoxWin64.exe Token: SeSecurityPrivilege 4856 GameBoxWin64.exe Token: SeTakeOwnershipPrivilege 4856 GameBoxWin64.exe Token: SeLoadDriverPrivilege 4856 GameBoxWin64.exe Token: SeSystemProfilePrivilege 4856 GameBoxWin64.exe Token: SeSystemtimePrivilege 4856 GameBoxWin64.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
JtS4xX5pg56xxh_LNk0OMRUm.tmpGameBoxWin64.exeWeather Installation.exeCleaner Installation.exeCleaner.exemsedge.exepid process 5316 JtS4xX5pg56xxh_LNk0OMRUm.tmp 4856 GameBoxWin64.exe 5664 Weather Installation.exe 3896 Cleaner Installation.exe 3496 Cleaner.exe 228 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8 (4).exesetup_installer.exesvchost.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exeWerFault.exeWerFault.exesonia_6.exeWerFault.exeWerFault.exerUNdlL32.eXeWerFault.exesonia_5.exedescription pid process target process PID 4680 wrote to memory of 4292 4680 8 (4).exe setup_installer.exe PID 4680 wrote to memory of 4292 4680 8 (4).exe setup_installer.exe PID 4680 wrote to memory of 4292 4680 8 (4).exe setup_installer.exe PID 4292 wrote to memory of 4656 4292 setup_installer.exe setup_install.exe PID 4292 wrote to memory of 4656 4292 setup_installer.exe setup_install.exe PID 4292 wrote to memory of 4656 4292 setup_installer.exe setup_install.exe PID 5016 wrote to memory of 908 5016 svchost.exe pcaui.exe PID 5016 wrote to memory of 908 5016 svchost.exe pcaui.exe PID 4656 wrote to memory of 2900 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 2900 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 2900 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 2912 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 2912 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 2912 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4236 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4236 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4236 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3296 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3296 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3296 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3720 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3720 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3720 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3912 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3912 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 3912 4656 setup_install.exe cmd.exe PID 3296 wrote to memory of 3932 3296 cmd.exe sonia_4.exe PID 3296 wrote to memory of 3932 3296 cmd.exe sonia_4.exe PID 3720 wrote to memory of 4256 3720 cmd.exe sonia_5.exe PID 3720 wrote to memory of 4256 3720 cmd.exe sonia_5.exe PID 3720 wrote to memory of 4256 3720 cmd.exe sonia_5.exe PID 4656 wrote to memory of 4400 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4400 4656 setup_install.exe cmd.exe PID 4656 wrote to memory of 4400 4656 setup_install.exe cmd.exe PID 2900 wrote to memory of 4348 2900 cmd.exe WerFault.exe PID 2900 wrote to memory of 4348 2900 cmd.exe WerFault.exe PID 2900 wrote to memory of 4348 2900 cmd.exe WerFault.exe PID 2912 wrote to memory of 3492 2912 cmd.exe sonia_2.exe PID 2912 wrote to memory of 3492 2912 cmd.exe sonia_2.exe PID 2912 wrote to memory of 3492 2912 cmd.exe sonia_2.exe PID 3912 wrote to memory of 512 3912 cmd.exe sonia_6.exe PID 3912 wrote to memory of 512 3912 cmd.exe sonia_6.exe PID 3912 wrote to memory of 512 3912 cmd.exe sonia_6.exe PID 4236 wrote to memory of 3744 4236 cmd.exe sonia_3.exe PID 4236 wrote to memory of 3744 4236 cmd.exe sonia_3.exe PID 4236 wrote to memory of 3744 4236 cmd.exe sonia_3.exe PID 4492 wrote to memory of 4656 4492 WerFault.exe setup_install.exe PID 4492 wrote to memory of 4656 4492 WerFault.exe setup_install.exe PID 4348 wrote to memory of 3940 4348 WerFault.exe sonia_1.exe PID 4348 wrote to memory of 3940 4348 WerFault.exe sonia_1.exe PID 4348 wrote to memory of 3940 4348 WerFault.exe sonia_1.exe PID 512 wrote to memory of 5020 512 sonia_6.exe WerFault.exe PID 512 wrote to memory of 5020 512 sonia_6.exe WerFault.exe PID 512 wrote to memory of 5020 512 sonia_6.exe WerFault.exe PID 3184 wrote to memory of 3492 3184 WerFault.exe sonia_2.exe PID 3184 wrote to memory of 3492 3184 WerFault.exe sonia_2.exe PID 5020 wrote to memory of 3744 5020 WerFault.exe god7mdfnF5Hnj_XIiFbABBUg.exe PID 5020 wrote to memory of 3744 5020 WerFault.exe god7mdfnF5Hnj_XIiFbABBUg.exe PID 4032 wrote to memory of 4600 4032 rUNdlL32.eXe rundll32.exe PID 4032 wrote to memory of 4600 4032 rUNdlL32.eXe rundll32.exe PID 4032 wrote to memory of 4600 4032 rUNdlL32.eXe rundll32.exe PID 3032 wrote to memory of 4600 3032 WerFault.exe rundll32.exe PID 3032 wrote to memory of 4600 3032 WerFault.exe rundll32.exe PID 4256 wrote to memory of 3184 4256 sonia_5.exe KcM_aXJkNcTcljKDf8gG11wo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8 (4).exe"C:\Users\Admin\AppData\Local\Temp\8 (4).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_1.exesonia_1.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3744 -s 2446⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 2446⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\obOYO9tzCg15blk8m_371Z_K.exe"C:\Users\Admin\Documents\obOYO9tzCg15blk8m_371Z_K.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\DBAyf2zrlAo1c_2A5SJZjVeL.exe"C:\Users\Admin\Documents\DBAyf2zrlAo1c_2A5SJZjVeL.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\CExPm2teptKJM3U3nqqgCPm0.exe"C:\Users\Admin\Documents\CExPm2teptKJM3U3nqqgCPm0.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\CExPm2teptKJM3U3nqqgCPm0.exe"C:\Users\Admin\Documents\CExPm2teptKJM3U3nqqgCPm0.exe"7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\V4YrPI8QpGX9Ucokzw4oW8fP.exe"C:\Users\Admin\Documents\V4YrPI8QpGX9Ucokzw4oW8fP.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 2767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\god7mdfnF5Hnj_XIiFbABBUg.exe"C:\Users\Admin\Documents\god7mdfnF5Hnj_XIiFbABBUg.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\Documents\KcM_aXJkNcTcljKDf8gG11wo.exe"C:\Users\Admin\Documents\KcM_aXJkNcTcljKDf8gG11wo.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\KcM_aXJkNcTcljKDf8gG11wo.exeC:\Users\Admin\Documents\KcM_aXJkNcTcljKDf8gG11wo.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\TL72W7u8qebE9iUtdhAHthYF.exe"C:\Users\Admin\Documents\TL72W7u8qebE9iUtdhAHthYF.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1022245.exe"C:\Users\Admin\AppData\Roaming\1022245.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4480 -s 24248⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\7129630.exe"C:\Users\Admin\AppData\Roaming\7129630.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\BqqjQitAqMx10VLZYGXnOVUv.exe"C:\Users\Admin\Documents\BqqjQitAqMx10VLZYGXnOVUv.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2557933.exe"C:\Users\Admin\AppData\Roaming\2557933.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1420 -s 24088⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\2113434.exe"C:\Users\Admin\AppData\Roaming\2113434.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\WpluEqYqtl60fUrXodfxKZKw.exe"C:\Users\Admin\Documents\WpluEqYqtl60fUrXodfxKZKw.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5300 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\SG_ecBNA0JiSzLp3dJc4h3im.exe"C:\Users\Admin\Documents\SG_ecBNA0JiSzLp3dJc4h3im.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exe"C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exe"C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exe"7⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff015646f8,0x7fff01564708,0x7fff015647189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3536 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3532 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5492 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2052,6583573443563056996,2027287961941557962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5228 /prefetch:89⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 4168 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exe"8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 41689⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 4168 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exe"8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 41689⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\bkQZw1gCVF9krsiOQVj1lfKN.exe"C:\Users\Admin\Documents\bkQZw1gCVF9krsiOQVj1lfKN.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"7⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Users\Admin\Documents\ezTQ8CM6JbC6ER4SHNsPg1zd.exe"C:\Users\Admin\Documents\ezTQ8CM6JbC6ER4SHNsPg1zd.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\qdeiSzvFWIvFVz6SZp4bDwDR.exe"C:\Users\Admin\Documents\qdeiSzvFWIvFVz6SZp4bDwDR.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8272398.exe"C:\Users\Admin\AppData\Roaming\8272398.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7103215.exe"C:\Users\Admin\AppData\Roaming\7103215.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\7216578.exe"C:\Users\Admin\AppData\Roaming\7216578.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5560 -s 25448⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\5872873.exe"C:\Users\Admin\AppData\Roaming\5872873.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2492 -s 23288⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\Qzak0bYOl0HYykP9CNoT0QGa.exe"C:\Users\Admin\Documents\Qzak0bYOl0HYykP9CNoT0QGa.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5184 -s 2727⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\A5oXGGRIWoEPa64uoj0Sne_X.exe"C:\Users\Admin\Documents\A5oXGGRIWoEPa64uoj0Sne_X.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 2367⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\5yUPJBDPvl3fT0Gl5djpika6.exe"C:\Users\Admin\Documents\5yUPJBDPvl3fT0Gl5djpika6.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 2807⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\JtS4xX5pg56xxh_LNk0OMRUm.exe"C:\Users\Admin\Documents\JtS4xX5pg56xxh_LNk0OMRUm.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LS6E9.tmp\JtS4xX5pg56xxh_LNk0OMRUm.tmp"C:\Users\Admin\AppData\Local\Temp\is-LS6E9.tmp\JtS4xX5pg56xxh_LNk0OMRUm.tmp" /SL5="$50166,138429,56832,C:\Users\Admin\Documents\JtS4xX5pg56xxh_LNk0OMRUm.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-SAT04.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-SAT04.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 4924⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wlrmdr.exe-c -s 0 -f 0 -t Empty -m Empty -a 0 -u Empty1⤵
-
C:\Windows\system32\MoNotificationUx.exe%systemroot%\system32\MoNotificationUx.exe /ClearActiveNotifications1⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\pcaui.exeC:\Windows\System32\pcaui.exe -n 0 -a "" -v "" -g "" -x ""2⤵
-
C:\Windows\system32\MoNotificationUx.exe%systemroot%\system32\MoNotificationUx.exe /ClearActiveNotifications1⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4656 -ip 46561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3492 -ip 34921⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3744 -ip 37441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4600 -ip 46001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4236 -ip 42361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5184 -ip 51841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5160 -ip 51601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5172 -ip 51721⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 2802⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4160 -ip 41601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\3536827.exe"C:\Users\Admin\AppData\Roaming\3536827.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3300 -s 23243⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\5404278.exe"C:\Users\Admin\AppData\Roaming\5404278.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\8082108.exe"C:\Users\Admin\AppData\Roaming\8082108.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 24883⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\8108524.exe"C:\Users\Admin\AppData\Roaming\8108524.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"1⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a2⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=7151⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590694 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"2⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590694 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"2⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LDTGQ.tmp\GameBoxWin32.tmp"C:\Users\Admin\AppData\Local\Temp\is-LDTGQ.tmp\GameBoxWin32.tmp" /SL5="$4030A,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590694 /qn CAMPAIGN=""710"" " CAMPAIGN="710"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5300 -ip 53001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EA41C2FAFED15A1DFB7CBED626AC9A33 C2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 547B522BF59612A8C256B2BF0D75CCB1 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1607442C9C320D4DE8A2684EA59EE396 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 25F2961CA71C55F091F1E4461CEE9D2F2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default3⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"4⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exeC:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ffef8f2dec0,0x7ffef8f2ded0,0x7ffef8f2dee05⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1608 /prefetch:25⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --mojo-platform-channel-handle=2108 /prefetch:85⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --mojo-platform-channel-handle=2088 /prefetch:85⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2536 /prefetch:15⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2568 /prefetch:15⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3212 /prefetch:25⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --mojo-platform-channel-handle=3232 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --mojo-platform-channel-handle=3556 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --mojo-platform-channel-handle=3612 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --mojo-platform-channel-handle=3708 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1592,6350574832893002511,12424336288445489766,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw3496_1570217890" --mojo-platform-channel-handle=2224 /prefetch:85⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_9C31.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"3⤵
- Blocklisted process makes network request
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3404 -ip 34041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 592 -p 2492 -ip 24921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 676 -p 1420 -ip 14201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 676 -p 4480 -ip 44801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 5560 -ip 55601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 360 -p 3300 -ip 33001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 5048 -ip 50481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
- Writes to the Master Boot Record (MBR)
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc1⤵
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_1.txtMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_2.exeMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_2.txtMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_3.exeMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_3.txtMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_4.exeMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_4.txtMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_5.exeMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_5.txtMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_6.exeMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\7zS4C0A59B3\sonia_6.txtMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
99ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\Documents\5yUPJBDPvl3fT0Gl5djpika6.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
C:\Users\Admin\Documents\5yUPJBDPvl3fT0Gl5djpika6.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
C:\Users\Admin\Documents\A5oXGGRIWoEPa64uoj0Sne_X.exeMD5
ab8781ed006eff23e2f4391e9d87d33c
SHA1d557dc317e733bcc896a08158c4bc978b524c689
SHA2566543fb158c4d0ace63d292da67d86920914c57280adeb9726694cb7805f7466b
SHA51273c8f4b37d076e2d8606375d3bbc821ccaab5b82ba68e8b2aad48881dcb893ce218334cdaa026acc426080599794240157a6e56ceaa2979276e8e983dfc61a69
-
C:\Users\Admin\Documents\A5oXGGRIWoEPa64uoj0Sne_X.exeMD5
ab8781ed006eff23e2f4391e9d87d33c
SHA1d557dc317e733bcc896a08158c4bc978b524c689
SHA2566543fb158c4d0ace63d292da67d86920914c57280adeb9726694cb7805f7466b
SHA51273c8f4b37d076e2d8606375d3bbc821ccaab5b82ba68e8b2aad48881dcb893ce218334cdaa026acc426080599794240157a6e56ceaa2979276e8e983dfc61a69
-
C:\Users\Admin\Documents\BqqjQitAqMx10VLZYGXnOVUv.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\BqqjQitAqMx10VLZYGXnOVUv.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\CExPm2teptKJM3U3nqqgCPm0.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\CExPm2teptKJM3U3nqqgCPm0.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\DBAyf2zrlAo1c_2A5SJZjVeL.exeMD5
f8d92d2f91fd134e57b6764c0eba5de3
SHA11ed71b2e5a398c1c1bc5f33cfe462d471a48fa52
SHA256420379eae2cab153a4f538c5c9b68d848e78d5c336c8e7e13a923913eb9ba32c
SHA51247d514492022932bb03f771d51bb1909235f9ebf7152b502e2412052628ff85c0342de42b4da8644c820b8bcf1e52fcace0fbc82c32c6216b4c2da56cf5eac71
-
C:\Users\Admin\Documents\KcM_aXJkNcTcljKDf8gG11wo.exeMD5
47e86cc0cafdce94d5c05a5c9c5c388e
SHA1de4fcbdcc06a0d748a82666bfc1ec4e4a08e5be6
SHA2561d7d718be5b978fedd1124fa44831ba54af5bda0507f6eee05a0a8c8d9badda1
SHA512e8d4012ee736c1d256e03bd1756ebd5a0349c0b77903bf71ad80cf40ee3c586e32b1e1278bd54b6b58b58152a9382a4726b8242b98ac4665ba1d0ebecb50e47e
-
C:\Users\Admin\Documents\KcM_aXJkNcTcljKDf8gG11wo.exeMD5
47e86cc0cafdce94d5c05a5c9c5c388e
SHA1de4fcbdcc06a0d748a82666bfc1ec4e4a08e5be6
SHA2561d7d718be5b978fedd1124fa44831ba54af5bda0507f6eee05a0a8c8d9badda1
SHA512e8d4012ee736c1d256e03bd1756ebd5a0349c0b77903bf71ad80cf40ee3c586e32b1e1278bd54b6b58b58152a9382a4726b8242b98ac4665ba1d0ebecb50e47e
-
C:\Users\Admin\Documents\Qzak0bYOl0HYykP9CNoT0QGa.exeMD5
f550d370e8256649934a6c9052b0803c
SHA1cb7bc0a067bbbe77b306b87e2b4d3f0e9ce89175
SHA256175b0b3d82bc46f9178ca9051066496e464d846270f5abc7d2b5db01233efbc5
SHA512c19ef1e5d893ec8f53bdec76f6f6c23a712d53035c99cb2a9bef23899896d4be1a03378f512fce3c8fd87edbadc5f12fea8b1efbdec164dbd373632933f5b2b9
-
C:\Users\Admin\Documents\Qzak0bYOl0HYykP9CNoT0QGa.exeMD5
f550d370e8256649934a6c9052b0803c
SHA1cb7bc0a067bbbe77b306b87e2b4d3f0e9ce89175
SHA256175b0b3d82bc46f9178ca9051066496e464d846270f5abc7d2b5db01233efbc5
SHA512c19ef1e5d893ec8f53bdec76f6f6c23a712d53035c99cb2a9bef23899896d4be1a03378f512fce3c8fd87edbadc5f12fea8b1efbdec164dbd373632933f5b2b9
-
C:\Users\Admin\Documents\SG_ecBNA0JiSzLp3dJc4h3im.exeMD5
060e727c298a99826cabfacfee33321f
SHA1c94a1ab7b04f8f3bcba8538a901c7ae5f253c9aa
SHA256440fe79cbaf72137d3062df26751a1c8cf8b0e1ce56ad66d4fac66cf56cf6a02
SHA5126baddb62b3a6e592a2009c00029180a2eddb5e07773c900d0adbd29aeea2306586102493ecd18832b06254702a59be97933f38b78e8529d18e8e720896c30ef5
-
C:\Users\Admin\Documents\TL72W7u8qebE9iUtdhAHthYF.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\TL72W7u8qebE9iUtdhAHthYF.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\V4YrPI8QpGX9Ucokzw4oW8fP.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\V4YrPI8QpGX9Ucokzw4oW8fP.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\WpluEqYqtl60fUrXodfxKZKw.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\WpluEqYqtl60fUrXodfxKZKw.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\bkQZw1gCVF9krsiOQVj1lfKN.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\bkQZw1gCVF9krsiOQVj1lfKN.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\ezTQ8CM6JbC6ER4SHNsPg1zd.exeMD5
0f73a44e00e05a2257c26a0ab3eb84ab
SHA19c90dac9386f8ef2a44fac90f154a42173461a60
SHA256d256af9cf801950977e5c289587c7c9664d75d0d36e8b19c55e5e9b0ec0312a5
SHA512a3d479ad86ca6dd16298311f5244fc74e9c8711a8dc7bc45bb7f247e911e037f3258a353e2059538170b32800f9665593b7d4a3d7707770a7f79e5cc62bc0261
-
C:\Users\Admin\Documents\god7mdfnF5Hnj_XIiFbABBUg.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\god7mdfnF5Hnj_XIiFbABBUg.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\j1tdMXakQkoMjZWj5pICYBq1.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\obOYO9tzCg15blk8m_371Z_K.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\obOYO9tzCg15blk8m_371Z_K.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\qdeiSzvFWIvFVz6SZp4bDwDR.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\qdeiSzvFWIvFVz6SZp4bDwDR.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
memory/512-192-0x0000000000000000-mapping.dmp
-
memory/908-149-0x0000000000000000-mapping.dmp
-
memory/1332-526-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/1392-302-0x0000000000000000-mapping.dmp
-
memory/1420-331-0x0000000000000000-mapping.dmp
-
memory/1420-378-0x000000001B440000-0x000000001B442000-memory.dmpFilesize
8KB
-
memory/1460-334-0x0000000000000000-mapping.dmp
-
memory/1460-460-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/1936-423-0x0000000000000000-mapping.dmp
-
memory/2000-345-0x0000000000000000-mapping.dmp
-
memory/2000-458-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/2492-316-0x0000000000000000-mapping.dmp
-
memory/2492-382-0x000000001AC10000-0x000000001AC12000-memory.dmpFilesize
8KB
-
memory/2492-325-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2492-351-0x0000000001FF0000-0x000000000201B000-memory.dmpFilesize
172KB
-
memory/2688-452-0x0000000000000000-mapping.dmp
-
memory/2752-328-0x0000000000000000-mapping.dmp
-
memory/2752-343-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/2816-487-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/2816-459-0x0000000000000000-mapping.dmp
-
memory/2900-173-0x0000000000000000-mapping.dmp
-
memory/2912-174-0x0000000000000000-mapping.dmp
-
memory/3084-471-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3092-507-0x0000024F8CD50000-0x0000024F8CE1D000-memory.dmpFilesize
820KB
-
memory/3092-450-0x0000000000000000-mapping.dmp
-
memory/3092-509-0x0000024F8CF50000-0x0000024F8D082000-memory.dmpFilesize
1.2MB
-
memory/3184-290-0x0000000005800000-0x0000000005DA6000-memory.dmpFilesize
5.6MB
-
memory/3184-271-0x0000000005DB0000-0x0000000005DB1000-memory.dmpFilesize
4KB
-
memory/3184-275-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/3184-296-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/3184-259-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/3184-211-0x0000000000000000-mapping.dmp
-
memory/3296-176-0x0000000000000000-mapping.dmp
-
memory/3312-414-0x0000000000000000-mapping.dmp
-
memory/3492-189-0x0000000000000000-mapping.dmp
-
memory/3492-205-0x0000000000950000-0x0000000000959000-memory.dmpFilesize
36KB
-
memory/3720-178-0x0000000000000000-mapping.dmp
-
memory/3744-206-0x0000000000BB0000-0x0000000000C4D000-memory.dmpFilesize
628KB
-
memory/3744-193-0x0000000000000000-mapping.dmp
-
memory/3744-306-0x0000024028DB0000-0x0000024028E1F000-memory.dmpFilesize
444KB
-
memory/3744-212-0x0000000000000000-mapping.dmp
-
memory/3744-308-0x0000024028E20000-0x0000024028EEF000-memory.dmpFilesize
828KB
-
memory/3912-180-0x0000000000000000-mapping.dmp
-
memory/3932-198-0x000000001AF20000-0x000000001AF22000-memory.dmpFilesize
8KB
-
memory/3932-181-0x0000000000000000-mapping.dmp
-
memory/3932-196-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/3940-199-0x0000000000000000-mapping.dmp
-
memory/3988-418-0x0000000000000000-mapping.dmp
-
memory/4160-451-0x0000000004890000-0x0000000004923000-memory.dmpFilesize
588KB
-
memory/4160-429-0x0000000000000000-mapping.dmp
-
memory/4236-272-0x0000000004A20000-0x0000000004ABD000-memory.dmpFilesize
628KB
-
memory/4236-213-0x0000000000000000-mapping.dmp
-
memory/4236-175-0x0000000000000000-mapping.dmp
-
memory/4256-183-0x0000000000000000-mapping.dmp
-
memory/4292-146-0x0000000000000000-mapping.dmp
-
memory/4348-188-0x0000000000000000-mapping.dmp
-
memory/4400-320-0x0000000000000000-mapping.dmp
-
memory/4400-184-0x0000000000000000-mapping.dmp
-
memory/4480-341-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/4480-318-0x0000000000000000-mapping.dmp
-
memory/4480-374-0x000000001BBC0000-0x000000001BBC2000-memory.dmpFilesize
8KB
-
memory/4600-207-0x0000000000000000-mapping.dmp
-
memory/4608-340-0x0000000000000000-mapping.dmp
-
memory/4608-455-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/4656-182-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4656-163-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4656-185-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4656-164-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4656-179-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4656-177-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4656-166-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/4656-165-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4656-151-0x0000000000000000-mapping.dmp
-
memory/4700-214-0x0000000000000000-mapping.dmp
-
memory/4700-276-0x0000000002F50000-0x0000000002F5A000-memory.dmpFilesize
40KB
-
memory/4828-504-0x0000000005130000-0x0000000005748000-memory.dmpFilesize
6.1MB
-
memory/4856-435-0x0000000000000000-mapping.dmp
-
memory/5020-201-0x0000000000000000-mapping.dmp
-
memory/5048-523-0x0000000005180000-0x0000000005181000-memory.dmpFilesize
4KB
-
memory/5132-313-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/5132-367-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/5132-215-0x0000000000000000-mapping.dmp
-
memory/5148-216-0x0000000000000000-mapping.dmp
-
memory/5148-258-0x0000000002710000-0x0000000002722000-memory.dmpFilesize
72KB
-
memory/5148-239-0x00000000026F0000-0x0000000002700000-memory.dmpFilesize
64KB
-
memory/5160-217-0x0000000000000000-mapping.dmp
-
memory/5160-264-0x0000000002E30000-0x0000000002E39000-memory.dmpFilesize
36KB
-
memory/5172-218-0x0000000000000000-mapping.dmp
-
memory/5172-416-0x0000000000AC0000-0x0000000000AEF000-memory.dmpFilesize
188KB
-
memory/5184-219-0x0000000000000000-mapping.dmp
-
memory/5184-268-0x00000000049C0000-0x0000000004A5D000-memory.dmpFilesize
628KB
-
memory/5196-220-0x0000000000000000-mapping.dmp
-
memory/5196-261-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/5196-288-0x0000000002E10000-0x0000000002E12000-memory.dmpFilesize
8KB
-
memory/5196-279-0x0000000002DF0000-0x0000000002E05000-memory.dmpFilesize
84KB
-
memory/5208-221-0x0000000000000000-mapping.dmp
-
memory/5208-309-0x0000000000620000-0x0000000000621000-memory.dmpFilesize
4KB
-
memory/5208-356-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/5232-300-0x0000000000000000-mapping.dmp
-
memory/5232-310-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5240-225-0x0000000000000000-mapping.dmp
-
memory/5256-227-0x0000000000000000-mapping.dmp
-
memory/5256-260-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/5256-280-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/5256-284-0x0000000005CE0000-0x0000000005CE1000-memory.dmpFilesize
4KB
-
memory/5256-298-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/5256-292-0x0000000005180000-0x0000000005726000-memory.dmpFilesize
5.6MB
-
memory/5276-324-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/5276-305-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/5276-228-0x0000000000000000-mapping.dmp
-
memory/5276-317-0x0000000005F60000-0x0000000005F61000-memory.dmpFilesize
4KB
-
memory/5276-321-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/5276-329-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/5276-360-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/5288-472-0x0000000002200000-0x0000000002201000-memory.dmpFilesize
4KB
-
memory/5300-231-0x0000000000000000-mapping.dmp
-
memory/5300-437-0x00000000016C0000-0x0000000001FE6000-memory.dmpFilesize
9.1MB
-
memory/5316-410-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/5316-398-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/5316-304-0x0000000000000000-mapping.dmp
-
memory/5316-364-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/5316-389-0x0000000005AD0000-0x0000000005AD1000-memory.dmpFilesize
4KB
-
memory/5316-391-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/5316-393-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/5316-396-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/5316-355-0x0000000005A80000-0x0000000005A81000-memory.dmpFilesize
4KB
-
memory/5316-401-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/5316-404-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/5316-314-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/5316-394-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/5316-385-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/5316-406-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/5316-342-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/5316-366-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/5316-333-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/5316-349-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/5316-371-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/5316-311-0x00000000031C0000-0x00000000031FC000-memory.dmpFilesize
240KB
-
memory/5324-234-0x0000000000000000-mapping.dmp
-
memory/5324-269-0x00000000004D0000-0x00000000004D1000-memory.dmpFilesize
4KB
-
memory/5324-295-0x0000000000CB0000-0x0000000000CB2000-memory.dmpFilesize
8KB
-
memory/5360-238-0x0000000000000000-mapping.dmp
-
memory/5360-294-0x000000001B9B0000-0x000000001B9B2000-memory.dmpFilesize
8KB
-
memory/5360-282-0x0000000001570000-0x0000000001585000-memory.dmpFilesize
84KB
-
memory/5560-372-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/5560-354-0x0000000000000000-mapping.dmp
-
memory/5632-447-0x0000000000000000-mapping.dmp
-
memory/5632-486-0x000000001B8A0000-0x000000001B8A2000-memory.dmpFilesize
8KB
-
memory/5644-359-0x0000000000000000-mapping.dmp
-
memory/5664-444-0x0000000000000000-mapping.dmp
-
memory/5704-285-0x0000000000000000-mapping.dmp
-
memory/5704-287-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/6036-289-0x0000000000000000-mapping.dmp
-
memory/6036-337-0x0000024B5CAD0000-0x0000024B5CB3E000-memory.dmpFilesize
440KB
-
memory/6036-419-0x0000024B5CB40000-0x0000024B5CC0F000-memory.dmpFilesize
828KB
-
memory/6088-299-0x0000000000400000-0x000000000067D000-memory.dmpFilesize
2.5MB
-
memory/6088-291-0x0000000000000000-mapping.dmp
-
memory/6132-293-0x0000000000000000-mapping.dmp
-
memory/6140-399-0x0000000000000000-mapping.dmp