Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
1368s -
max time network
1459s -
platform
windows11_x64 -
resource
win11 -
submitted
13-08-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
8 (3).exe
Resource
win11
Behavioral task
behavioral2
Sample
8 (30).exe
Resource
win11
Behavioral task
behavioral3
Sample
8 (31).exe
Resource
win11
Errors
General
-
Target
8 (6).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/864-451-0x00000000015E0000-0x0000000001F06000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXerUNdlL32.eXedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4840 4848 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3472 4848 rUNdlL32.eXe -
Raccoon Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/1456-447-0x0000000004A50000-0x0000000004AE3000-memory.dmp family_raccoon -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\Documents\k_nC9QIMxbuqGCFsy9nEyeYs.exe family_redline C:\Users\Admin\Documents\rAeuqqH7W_E8N4sD4i2Mamj5.exe family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 21 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1664 created 3704 1664 WerFault.exe setup_install.exe PID 3852 created 2456 3852 WerFault.exe sonia_2.exe PID 4084 created 4496 4084 WerFault.exe sonia_3.exe PID 868 created 4412 868 WerFault.exe rundll32.exe PID 592 created 4000 592 WerFault.exe zOhH0yARG6ZLOdj96Qqn1DsI.exe PID 3128 created 4336 3128 WerFault.exe C2HMYKJylTBmpIOVMqSSJj5S.exe PID 3092 created 4284 3092 WerFault.exe jW2zFNgCyb7z4MbUQrhESnjn.exe PID 1580 created 4180 1580 WerFault.exe Up8u6bt1kvmCBZ5hEXSLZ91H.exe PID 3732 created 1456 3732 WerFault.exe GameBox64bit.exe PID 3284 created 864 3284 WerFault.exe A7FuV_srshyeLzgToDNfiOYA.exe PID 3452 created 5140 3452 WerFault.exe 1F7.exe PID 5752 created 3936 5752 WerFault.exe 1266434.exe PID 5628 created 2940 5628 WerFault.exe 4337185.exe PID 3156 created 3924 3156 WerFault.exe 2915486.exe PID 5752 created 1604 5752 WerFault.exe 6684504.exe PID 1140 created 6100 1140 WerFault.exe svchost.exe PID 5948 created 5260 5948 WerFault.exe 7715603.exe PID 1512 created 2256 1512 WerFault.exe FCB6.exe PID 3784 created 5140 3784 WerFault.exe 1F7.exe PID 3256 created 4240 3256 WerFault.exe 5A2B.exe PID 4400 created 4796 4400 WerFault.exe explorer.exe -
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral5/memory/4496-203-0x0000000000C50000-0x0000000000CED000-memory.dmp family_vidar behavioral5/memory/4336-263-0x0000000004A40000-0x0000000004ADD000-memory.dmp family_vidar behavioral5/memory/4284-268-0x0000000004A10000-0x0000000004AAD000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\setup_install.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurlpp.dll aspack_v212_v242 -
Blocklisted process makes network request 10 IoCs
Processes:
MsiExec.exepowershell.exeflow pid process 149 784 MsiExec.exe 150 784 MsiExec.exe 152 784 MsiExec.exe 154 784 MsiExec.exe 155 784 MsiExec.exe 158 784 MsiExec.exe 160 784 MsiExec.exe 162 784 MsiExec.exe 181 3228 powershell.exe 182 3228 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
VKg6JumlIYA5aDXV7ctn7nLS.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts VKg6JumlIYA5aDXV7ctn7nLS.exe -
Executes dropped EXE 64 IoCs
Processes:
setup_installer.exesetup_install.exesonia_1.exesonia_4.exesonia_6.exesonia_3.exesonia_2.exesonia_5.exesonia_1.exejfiag3g_gg.exejfiag3g_gg.exeUp8u6bt1kvmCBZ5hEXSLZ91H.exeVKg6JumlIYA5aDXV7ctn7nLS.exekr4UZwTcSFk5fJ94r4F2QbTj.exe1fLK4HrOTgyWAhALwwv0FRVL.exezOhH0yARG6ZLOdj96Qqn1DsI.exeEHCSjZkQ9to0zuvbSv2EMvXJ.exejW2zFNgCyb7z4MbUQrhESnjn.exek_nC9QIMxbuqGCFsy9nEyeYs.exerAeuqqH7W_E8N4sD4i2Mamj5.exeN1NWVEaMNE_wc3IcbJIXX0Zb.exeC2HMYKJylTBmpIOVMqSSJj5S.exeA7FuV_srshyeLzgToDNfiOYA.exeGcfaqmHGKpUcuIXW3qzlmP51.exeRhciu3BLpDoZf6SGJLGjxGlE.exehf92vg9lOrb9yf59yEw0nT99.exegkewlUgKxbiC4QdRpvFyct_3.exeGcfaqmHGKpUcuIXW3qzlmP51.execustomer3.exeEa4btX9pLhf0VEyiuiiy92ST.exemd8_8eus.exejooyu.exeEa4btX9pLhf0VEyiuiiy92ST.tmp1266434.exe4058254.exe4337185.exe2915486.exe1135608.exe11111.exeWerFault.exeWerFault.exe7687493.exe6684504.exeSetup.exeGameBox64bit.exeGameBoxWin64.exeWeather Installation.exeGameBox.exe11111.exeGameBox32Bit.exeBotCheck.exemsiexec.exenote8876.exeGameBoxWin32.exeCleaner Installation.exe11111.exeGameBoxWin32.tmpWinHoster.exeBotCheck.exejfiag3g_gg.exe11111.exesvchost.exe11111.exe5316705.exepid process 3016 setup_installer.exe 3704 setup_install.exe 1176 sonia_1.exe 2112 sonia_4.exe 4500 sonia_6.exe 4496 sonia_3.exe 2456 sonia_2.exe 724 sonia_5.exe 4272 sonia_1.exe 4180 jfiag3g_gg.exe 4764 jfiag3g_gg.exe 4180 Up8u6bt1kvmCBZ5hEXSLZ91H.exe 4584 VKg6JumlIYA5aDXV7ctn7nLS.exe 660 kr4UZwTcSFk5fJ94r4F2QbTj.exe 4924 1fLK4HrOTgyWAhALwwv0FRVL.exe 4000 zOhH0yARG6ZLOdj96Qqn1DsI.exe 2524 EHCSjZkQ9to0zuvbSv2EMvXJ.exe 4284 jW2zFNgCyb7z4MbUQrhESnjn.exe 4044 k_nC9QIMxbuqGCFsy9nEyeYs.exe 1460 rAeuqqH7W_E8N4sD4i2Mamj5.exe 1596 N1NWVEaMNE_wc3IcbJIXX0Zb.exe 4336 C2HMYKJylTBmpIOVMqSSJj5S.exe 864 A7FuV_srshyeLzgToDNfiOYA.exe 4908 GcfaqmHGKpUcuIXW3qzlmP51.exe 2812 Rhciu3BLpDoZf6SGJLGjxGlE.exe 2184 hf92vg9lOrb9yf59yEw0nT99.exe 4840 gkewlUgKxbiC4QdRpvFyct_3.exe 5004 GcfaqmHGKpUcuIXW3qzlmP51.exe 3892 customer3.exe 3752 Ea4btX9pLhf0VEyiuiiy92ST.exe 580 md8_8eus.exe 4836 jooyu.exe 1140 Ea4btX9pLhf0VEyiuiiy92ST.tmp 3936 1266434.exe 2724 4058254.exe 2940 4337185.exe 3924 2915486.exe 3304 1135608.exe 3380 11111.exe 3452 WerFault.exe 3732 WerFault.exe 1764 7687493.exe 1604 6684504.exe 1920 Setup.exe 1456 GameBox64bit.exe 812 GameBoxWin64.exe 1364 Weather Installation.exe 1712 GameBox.exe 660 11111.exe 1008 GameBox32Bit.exe 3824 BotCheck.exe 3536 msiexec.exe 2396 note8876.exe 1724 GameBoxWin32.exe 4376 Cleaner Installation.exe 2468 11111.exe 1544 GameBoxWin32.tmp 5680 WinHoster.exe 5740 BotCheck.exe 5812 jfiag3g_gg.exe 6040 11111.exe 6100 svchost.exe 6084 11111.exe 1708 5316705.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule behavioral5/memory/580-295-0x0000000000400000-0x000000000067D000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
N1NWVEaMNE_wc3IcbJIXX0Zb.exerAeuqqH7W_E8N4sD4i2Mamj5.exek_nC9QIMxbuqGCFsy9nEyeYs.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion N1NWVEaMNE_wc3IcbJIXX0Zb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rAeuqqH7W_E8N4sD4i2Mamj5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rAeuqqH7W_E8N4sD4i2Mamj5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion k_nC9QIMxbuqGCFsy9nEyeYs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion k_nC9QIMxbuqGCFsy9nEyeYs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion N1NWVEaMNE_wc3IcbJIXX0Zb.exe -
Drops startup file 2 IoCs
Processes:
customer3.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe -
Loads dropped DLL 64 IoCs
Processes:
setup_install.exerundll32.exeEa4btX9pLhf0VEyiuiiy92ST.tmpWeather Installation.exeGameBoxWin64.exeCleaner Installation.exeGameBoxWin32.tmp1F7.exeMsiExec.exeMsiExec.exeMsiExec.exeMsiExec.exeCleaner_Installation.exe478.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exeCleaner.exepid process 3704 setup_install.exe 3704 setup_install.exe 3704 setup_install.exe 3704 setup_install.exe 3704 setup_install.exe 3704 setup_install.exe 4412 rundll32.exe 1140 Ea4btX9pLhf0VEyiuiiy92ST.tmp 1140 Ea4btX9pLhf0VEyiuiiy92ST.tmp 1364 Weather Installation.exe 812 GameBoxWin64.exe 812 GameBoxWin64.exe 4376 Cleaner Installation.exe 1544 GameBoxWin32.tmp 5140 1F7.exe 812 GameBoxWin64.exe 5880 MsiExec.exe 5880 MsiExec.exe 5904 MsiExec.exe 5808 MsiExec.exe 5808 MsiExec.exe 5904 MsiExec.exe 5808 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 784 MsiExec.exe 1120 Cleaner_Installation.exe 1120 Cleaner_Installation.exe 4272 478.exe 1120 Cleaner_Installation.exe 1120 Cleaner_Installation.exe 5268 Cleaner.exe 1120 Cleaner_Installation.exe 1120 Cleaner_Installation.exe 5268 Cleaner.exe 5268 Cleaner.exe 3344 Cleaner.exe 3536 Cleaner.exe 3964 Cleaner.exe 4384 Cleaner.exe 3964 Cleaner.exe 4384 Cleaner.exe 3964 Cleaner.exe 4384 Cleaner.exe 4352 Cleaner.exe 4352 Cleaner.exe 4352 Cleaner.exe 3300 Cleaner.exe 3300 Cleaner.exe 3300 Cleaner.exe 3300 Cleaner.exe 2092 Cleaner.exe 2092 Cleaner.exe 2092 Cleaner.exe 2092 Cleaner.exe 3964 Cleaner.exe 5764 Cleaner.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Documents\k_nC9QIMxbuqGCFsy9nEyeYs.exe themida C:\Users\Admin\Documents\rAeuqqH7W_E8N4sD4i2Mamj5.exe themida C:\Users\Admin\Documents\N1NWVEaMNE_wc3IcbJIXX0Zb.exe themida behavioral5/memory/4044-301-0x0000000000FD0000-0x0000000000FD1000-memory.dmp themida behavioral5/memory/1596-303-0x0000000000540000-0x0000000000541000-memory.dmp themida behavioral5/memory/1460-319-0x0000000000220000-0x0000000000221000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
msedge.exesonia_6.exeWerFault.exeaipackagechainer.exeCleaner_Installation.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5" msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" WerFault.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run aipackagechainer.exe Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\ aipackagechainer.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Cleaner_Installation.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cleaner = "C:\\Users\\Admin\\AppData\\Roaming\\Cleaner\\Cleaner.exe --anbfs" Cleaner_Installation.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
N1NWVEaMNE_wc3IcbJIXX0Zb.exek_nC9QIMxbuqGCFsy9nEyeYs.exerAeuqqH7W_E8N4sD4i2Mamj5.exemd8_8eus.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA N1NWVEaMNE_wc3IcbJIXX0Zb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA k_nC9QIMxbuqGCFsy9nEyeYs.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rAeuqqH7W_E8N4sD4i2Mamj5.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
GameBoxWin64.exemsiexec.exeCleaner Installation.exeWeather Installation.exesvchost.exedescription ioc process File opened (read-only) \??\K: GameBoxWin64.exe File opened (read-only) \??\L: GameBoxWin64.exe File opened (read-only) \??\T: GameBoxWin64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\X: Cleaner Installation.exe File opened (read-only) \??\I: Weather Installation.exe File opened (read-only) \??\O: Weather Installation.exe File opened (read-only) \??\Q: GameBoxWin64.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: Cleaner Installation.exe File opened (read-only) \??\F: Weather Installation.exe File opened (read-only) \??\J: Weather Installation.exe File opened (read-only) \??\X: GameBoxWin64.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: Weather Installation.exe File opened (read-only) \??\Y: Weather Installation.exe File opened (read-only) \??\D: svchost.exe File opened (read-only) \??\Z: GameBoxWin64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\E: Cleaner Installation.exe File opened (read-only) \??\I: GameBoxWin64.exe File opened (read-only) \??\A: Cleaner Installation.exe File opened (read-only) \??\R: Cleaner Installation.exe File opened (read-only) \??\S: Cleaner Installation.exe File opened (read-only) \??\O: GameBoxWin64.exe File opened (read-only) \??\K: Cleaner Installation.exe File opened (read-only) \??\G: Weather Installation.exe File opened (read-only) \??\S: Weather Installation.exe File opened (read-only) \??\S: GameBoxWin64.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: Cleaner Installation.exe File opened (read-only) \??\M: Cleaner Installation.exe File opened (read-only) \??\B: Weather Installation.exe File opened (read-only) \??\F: GameBoxWin64.exe File opened (read-only) \??\G: GameBoxWin64.exe File opened (read-only) \??\M: GameBoxWin64.exe File opened (read-only) \??\R: GameBoxWin64.exe File opened (read-only) \??\U: GameBoxWin64.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\R: Weather Installation.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: Cleaner Installation.exe File opened (read-only) \??\V: Cleaner Installation.exe File opened (read-only) \??\W: Cleaner Installation.exe File opened (read-only) \??\K: Weather Installation.exe File opened (read-only) \??\V: Weather Installation.exe File opened (read-only) \??\X: Weather Installation.exe File opened (read-only) \??\Z: Weather Installation.exe File opened (read-only) \??\A: GameBoxWin64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: Cleaner Installation.exe File opened (read-only) \??\P: Cleaner Installation.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: Weather Installation.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 14 ipinfo.io 17 ipinfo.io 30 ipinfo.io 83 ipinfo.io 5 ip-api.com -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
svchost.exedescription ioc process File opened for modification \??\PhysicalDrive0 svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
N1NWVEaMNE_wc3IcbJIXX0Zb.exek_nC9QIMxbuqGCFsy9nEyeYs.exerAeuqqH7W_E8N4sD4i2Mamj5.exepid process 1596 N1NWVEaMNE_wc3IcbJIXX0Zb.exe 4044 k_nC9QIMxbuqGCFsy9nEyeYs.exe 1460 rAeuqqH7W_E8N4sD4i2Mamj5.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
GcfaqmHGKpUcuIXW3qzlmP51.exe478.exeVKg6JumlIYA5aDXV7ctn7nLS.exedescription pid process target process PID 4908 set thread context of 5004 4908 GcfaqmHGKpUcuIXW3qzlmP51.exe GcfaqmHGKpUcuIXW3qzlmP51.exe PID 5972 set thread context of 4272 5972 478.exe 478.exe PID 4584 set thread context of 2784 4584 VKg6JumlIYA5aDXV7ctn7nLS.exe VKg6JumlIYA5aDXV7ctn7nLS.exe -
Drops file in Program Files directory 23 IoCs
Processes:
hf92vg9lOrb9yf59yEw0nT99.exeSetup.exemd8_8eus.exeVKg6JumlIYA5aDXV7ctn7nLS.exedescription ioc process File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini hf92vg9lOrb9yf59yEw0nT99.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Setup.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe hf92vg9lOrb9yf59yEw0nT99.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe hf92vg9lOrb9yf59yEw0nT99.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe hf92vg9lOrb9yf59yEw0nT99.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW md8_8eus.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\resources.pak VKg6JumlIYA5aDXV7ctn7nLS.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe hf92vg9lOrb9yf59yEw0nT99.exe -
Drops file in Windows directory 26 IoCs
Processes:
msiexec.exesvchost.exeWerFault.exedescription ioc process File created C:\Windows\Installer\SourceHash{B59E6947-D960-4A88-902E-F387AFD7DF1F} msiexec.exe File opened for modification C:\Windows\Installer\MSIEA8E.tmp msiexec.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.override svchost.exe File created C:\Windows\Installer\f74ccfa.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIE401.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE6A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3A17.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF673958111347F097.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIE1AC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE383.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE5F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE636.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF15AFAB96E2A3B682.TMP msiexec.exe File opened for modification C:\Windows\Installer\f74ccfa.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE1FB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIE4AE.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF556DC7FA4C4C4EC0.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFC795AE738B8556A6.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIECB2.tmp msiexec.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst svchost.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Installer\MSID382.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 21 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3980 3704 WerFault.exe setup_install.exe 1624 2456 WerFault.exe sonia_2.exe 3920 4496 WerFault.exe sonia_3.exe 4940 4412 WerFault.exe rundll32.exe 2036 4336 WerFault.exe C2HMYKJylTBmpIOVMqSSJj5S.exe 4904 4284 WerFault.exe jW2zFNgCyb7z4MbUQrhESnjn.exe 1448 4000 WerFault.exe zOhH0yARG6ZLOdj96Qqn1DsI.exe 3160 4180 WerFault.exe Up8u6bt1kvmCBZ5hEXSLZ91H.exe 1832 1456 WerFault.exe GameBox64bit.exe 5152 864 WerFault.exe A7FuV_srshyeLzgToDNfiOYA.exe 5628 5140 WerFault.exe rundll32.exe 5744 2940 WerFault.exe 4337185.exe 5220 3936 WerFault.exe 1266434.exe 5208 3924 WerFault.exe 2915486.exe 3156 1604 WerFault.exe 6684504.exe 1872 6100 WerFault.exe 3475669.exe 4676 5260 WerFault.exe 7715603.exe 3980 2256 WerFault.exe FCB6.exe 5352 5140 WerFault.exe 1F7.exe 5600 4240 WerFault.exe 5A2B.exe 1212 4796 WerFault.exe explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
GcfaqmHGKpUcuIXW3qzlmP51.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI GcfaqmHGKpUcuIXW3qzlmP51.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI GcfaqmHGKpUcuIXW3qzlmP51.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI GcfaqmHGKpUcuIXW3qzlmP51.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5932 timeout.exe -
Enumerates system info in registry 2 TTPs 45 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exemsedge.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 2812 taskkill.exe 1660 taskkill.exe -
Modifies data under HKEY_USERS 11 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordLength = "8" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ProviderPasswordCharacterGroups = "2" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Uninstall svchost.exe -
Modifies registry class 7 IoCs
Processes:
Cleaner.exeCleaner.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\Instance\ Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{1CF30A3D-D816-440F-811E-B77601E5F08B} Cleaner.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-257790753-2419383948-818201544-1000\{EC370FEF-EB16-40FF-89A5-90F860C6C2B3} Cleaner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ -
Processes:
Cleaner Installation.exeGameBoxWin64.exeWeather Installation.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B Weather Installation.exe Set value (data) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 Weather Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Cleaner Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Cleaner Installation.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Cleaner Installation.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Cleaner Installation.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 81 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 88 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exejfiag3g_gg.exeGcfaqmHGKpUcuIXW3qzlmP51.exeWerFault.exeWerFault.exeWerFault.exepid process 3980 WerFault.exe 3980 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 3920 WerFault.exe 3920 WerFault.exe 4940 WerFault.exe 4940 WerFault.exe 4764 jfiag3g_gg.exe 4764 jfiag3g_gg.exe 5004 GcfaqmHGKpUcuIXW3qzlmP51.exe 5004 GcfaqmHGKpUcuIXW3qzlmP51.exe 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 1448 WerFault.exe 1448 WerFault.exe 2036 WerFault.exe 2036 WerFault.exe 3192 3192 3192 3192 3192 3192 3192 3192 4904 WerFault.exe 4904 WerFault.exe 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3192 -
Suspicious behavior: MapViewOfSection 43 IoCs
Processes:
GcfaqmHGKpUcuIXW3qzlmP51.exeexplorer.exepid process 5004 GcfaqmHGKpUcuIXW3qzlmP51.exe 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 3192 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe 5732 explorer.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
5316705.exepid process 1708 5316705.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exesonia_4.exeWerFault.exeRhciu3BLpDoZf6SGJLGjxGlE.exe11111.exegkewlUgKxbiC4QdRpvFyct_3.exeN1NWVEaMNE_wc3IcbJIXX0Zb.exek_nC9QIMxbuqGCFsy9nEyeYs.exerAeuqqH7W_E8N4sD4i2Mamj5.exe4337185.exe1266434.exe6684504.exedescription pid process Token: SeSystemEnvironmentPrivilege 4136 svchost.exe Token: SeDebugPrivilege 2112 sonia_4.exe Token: SeRestorePrivilege 3980 WerFault.exe Token: SeBackupPrivilege 3980 WerFault.exe Token: SeBackupPrivilege 3980 WerFault.exe Token: SeDebugPrivilege 2812 Rhciu3BLpDoZf6SGJLGjxGlE.exe Token: SeDebugPrivilege 660 11111.exe Token: SeDebugPrivilege 4840 gkewlUgKxbiC4QdRpvFyct_3.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 1596 N1NWVEaMNE_wc3IcbJIXX0Zb.exe Token: SeDebugPrivilege 4044 k_nC9QIMxbuqGCFsy9nEyeYs.exe Token: SeDebugPrivilege 1460 rAeuqqH7W_E8N4sD4i2Mamj5.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 2940 4337185.exe Token: SeDebugPrivilege 3936 1266434.exe Token: SeShutdownPrivilege 3192 Token: SeCreatePagefilePrivilege 3192 Token: SeDebugPrivilege 1604 6684504.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
WerFault.exeWeather Installation.exeGameBoxWin64.exeCleaner Installation.exeCleaner.exemsedge.exepid process 1140 WerFault.exe 1364 Weather Installation.exe 812 GameBoxWin64.exe 4376 Cleaner Installation.exe 5268 Cleaner.exe 3228 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
F6D9.exepid process 4556 F6D9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8 (6).exesetup_installer.exesvchost.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exeWerFault.exesonia_1.exeWerFault.exeWerFault.exesonia_6.exerUNdlL32.eXeWerFault.exedescription pid process target process PID 3776 wrote to memory of 3016 3776 8 (6).exe setup_installer.exe PID 3776 wrote to memory of 3016 3776 8 (6).exe setup_installer.exe PID 3776 wrote to memory of 3016 3776 8 (6).exe setup_installer.exe PID 3016 wrote to memory of 3704 3016 setup_installer.exe setup_install.exe PID 3016 wrote to memory of 3704 3016 setup_installer.exe setup_install.exe PID 3016 wrote to memory of 3704 3016 setup_installer.exe setup_install.exe PID 4648 wrote to memory of 4592 4648 svchost.exe pcaui.exe PID 4648 wrote to memory of 4592 4648 svchost.exe pcaui.exe PID 3704 wrote to memory of 3000 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3000 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3000 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 872 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 872 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 872 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3560 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3560 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3560 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3188 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3188 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3188 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3548 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3548 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 3548 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 4988 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 4988 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 4988 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 1268 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 1268 3704 setup_install.exe cmd.exe PID 3704 wrote to memory of 1268 3704 setup_install.exe cmd.exe PID 3000 wrote to memory of 1176 3000 cmd.exe sonia_1.exe PID 3000 wrote to memory of 1176 3000 cmd.exe sonia_1.exe PID 3000 wrote to memory of 1176 3000 cmd.exe sonia_1.exe PID 3188 wrote to memory of 2112 3188 cmd.exe sonia_4.exe PID 3188 wrote to memory of 2112 3188 cmd.exe sonia_4.exe PID 3560 wrote to memory of 4496 3560 cmd.exe sonia_3.exe PID 3560 wrote to memory of 4496 3560 cmd.exe sonia_3.exe PID 3560 wrote to memory of 4496 3560 cmd.exe sonia_3.exe PID 4988 wrote to memory of 4500 4988 cmd.exe sonia_6.exe PID 4988 wrote to memory of 4500 4988 cmd.exe sonia_6.exe PID 4988 wrote to memory of 4500 4988 cmd.exe sonia_6.exe PID 872 wrote to memory of 2456 872 cmd.exe sonia_2.exe PID 872 wrote to memory of 2456 872 cmd.exe sonia_2.exe PID 872 wrote to memory of 2456 872 cmd.exe sonia_2.exe PID 3548 wrote to memory of 724 3548 cmd.exe sonia_5.exe PID 3548 wrote to memory of 724 3548 cmd.exe sonia_5.exe PID 3548 wrote to memory of 724 3548 cmd.exe sonia_5.exe PID 1664 wrote to memory of 3704 1664 WerFault.exe setup_install.exe PID 1664 wrote to memory of 3704 1664 WerFault.exe setup_install.exe PID 1176 wrote to memory of 4272 1176 sonia_1.exe sonia_1.exe PID 1176 wrote to memory of 4272 1176 sonia_1.exe sonia_1.exe PID 1176 wrote to memory of 4272 1176 sonia_1.exe sonia_1.exe PID 3852 wrote to memory of 2456 3852 WerFault.exe sonia_2.exe PID 3852 wrote to memory of 2456 3852 WerFault.exe sonia_2.exe PID 4084 wrote to memory of 4496 4084 WerFault.exe sonia_3.exe PID 4084 wrote to memory of 4496 4084 WerFault.exe sonia_3.exe PID 4500 wrote to memory of 4180 4500 sonia_6.exe jfiag3g_gg.exe PID 4500 wrote to memory of 4180 4500 sonia_6.exe jfiag3g_gg.exe PID 4500 wrote to memory of 4180 4500 sonia_6.exe jfiag3g_gg.exe PID 4840 wrote to memory of 4412 4840 rUNdlL32.eXe rundll32.exe PID 4840 wrote to memory of 4412 4840 rUNdlL32.eXe rundll32.exe PID 4840 wrote to memory of 4412 4840 rUNdlL32.eXe rundll32.exe PID 868 wrote to memory of 4412 868 WerFault.exe rundll32.exe PID 868 wrote to memory of 4412 868 WerFault.exe rundll32.exe PID 4500 wrote to memory of 4764 4500 sonia_6.exe jfiag3g_gg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8 (6).exe"C:\Users\Admin\AppData\Local\Temp\8 (6).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_1.exe" -a6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 2486⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 2406⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\k_nC9QIMxbuqGCFsy9nEyeYs.exe"C:\Users\Admin\Documents\k_nC9QIMxbuqGCFsy9nEyeYs.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\jW2zFNgCyb7z4MbUQrhESnjn.exe"C:\Users\Admin\Documents\jW2zFNgCyb7z4MbUQrhESnjn.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 2807⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\EHCSjZkQ9to0zuvbSv2EMvXJ.exe"C:\Users\Admin\Documents\EHCSjZkQ9to0zuvbSv2EMvXJ.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\zOhH0yARG6ZLOdj96Qqn1DsI.exe"C:\Users\Admin\Documents\zOhH0yARG6ZLOdj96Qqn1DsI.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4000 -s 2807⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\1fLK4HrOTgyWAhALwwv0FRVL.exe"C:\Users\Admin\Documents\1fLK4HrOTgyWAhALwwv0FRVL.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
C:\Users\Admin\Documents\kr4UZwTcSFk5fJ94r4F2QbTj.exe"C:\Users\Admin\Documents\kr4UZwTcSFk5fJ94r4F2QbTj.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7574130.exe"C:\Users\Admin\AppData\Roaming\7574130.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\2915486.exe"C:\Users\Admin\AppData\Roaming\2915486.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3924 -s 23488⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\7687493.exe"C:\Users\Admin\AppData\Roaming\7687493.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6684504.exe"C:\Users\Admin\AppData\Roaming\6684504.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 25328⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exe"C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exe"C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exe"7⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"8⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x1dc,0x1e0,0x1e4,0x19c,0x1e8,0x7ffa0fb346f8,0x7ffa0fb34708,0x7ffa0fb347189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4776 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1824 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5728 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4060 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4044 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1984 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2116,17232528107486687596,14061496322342941297,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5920 /prefetch:89⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 2784 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exe"8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 27849⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 2784 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exe"8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 27849⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\Up8u6bt1kvmCBZ5hEXSLZ91H.exe"C:\Users\Admin\Documents\Up8u6bt1kvmCBZ5hEXSLZ91H.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\Rhciu3BLpDoZf6SGJLGjxGlE.exe"C:\Users\Admin\Documents\Rhciu3BLpDoZf6SGJLGjxGlE.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\1266434.exe"C:\Users\Admin\AppData\Roaming\1266434.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3936 -s 22568⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\4058254.exe"C:\Users\Admin\AppData\Roaming\4058254.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\GcfaqmHGKpUcuIXW3qzlmP51.exe"C:\Users\Admin\Documents\GcfaqmHGKpUcuIXW3qzlmP51.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\GcfaqmHGKpUcuIXW3qzlmP51.exe"C:\Users\Admin\Documents\GcfaqmHGKpUcuIXW3qzlmP51.exe"7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\A7FuV_srshyeLzgToDNfiOYA.exe"C:\Users\Admin\Documents\A7FuV_srshyeLzgToDNfiOYA.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\C2HMYKJylTBmpIOVMqSSJj5S.exe"C:\Users\Admin\Documents\C2HMYKJylTBmpIOVMqSSJj5S.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 2767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\N1NWVEaMNE_wc3IcbJIXX0Zb.exe"C:\Users\Admin\Documents\N1NWVEaMNE_wc3IcbJIXX0Zb.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\rAeuqqH7W_E8N4sD4i2Mamj5.exe"C:\Users\Admin\Documents\rAeuqqH7W_E8N4sD4i2Mamj5.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\hf92vg9lOrb9yf59yEw0nT99.exe"C:\Users\Admin\Documents\hf92vg9lOrb9yf59yEw0nT99.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"7⤵
- Executes dropped EXE
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\Documents\gkewlUgKxbiC4QdRpvFyct_3.exe"C:\Users\Admin\Documents\gkewlUgKxbiC4QdRpvFyct_3.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\4337185.exe"C:\Users\Admin\AppData\Roaming\4337185.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2940 -s 7288⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\1135608.exe"C:\Users\Admin\AppData\Roaming\1135608.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Ea4btX9pLhf0VEyiuiiy92ST.exe"C:\Users\Admin\Documents\Ea4btX9pLhf0VEyiuiiy92ST.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-H9K3U.tmp\Ea4btX9pLhf0VEyiuiiy92ST.tmp"C:\Users\Admin\AppData\Local\Temp\is-H9K3U.tmp\Ea4btX9pLhf0VEyiuiiy92ST.tmp" /SL5="$30124,138429,56832,C:\Users\Admin\Documents\Ea4btX9pLhf0VEyiuiiy92ST.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-2RN8J.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-2RN8J.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 28010⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=7159⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590692 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590692 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3475669.exe"C:\Users\Admin\AppData\Roaming\3475669.exe"10⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6100 -s 234011⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\5316705.exe"C:\Users\Admin\AppData\Roaming\5316705.exe"10⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\7296893.exe"C:\Users\Admin\AppData\Roaming\7296893.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\7715603.exe"C:\Users\Admin\AppData\Roaming\7715603.exe"10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 254411⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"9⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"9⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe"C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628590692 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-CGMLN.tmp\GameBoxWin32.tmp"C:\Users\Admin\AppData\Local\Temp\is-CGMLN.tmp\GameBoxWin32.tmp" /SL5="$202EC,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3704 -s 5804⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wlrmdr.exe-c -s 0 -f 0 -t Empty -m Empty -a 0 -u Empty1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\pcaui.exeC:\Windows\System32\pcaui.exe -n 0 -a "" -v "" -g "" -x ""2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3704 -ip 37041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2456 -ip 24561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4496 -ip 44961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 4563⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4412 -ip 44121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4000 -ip 40001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4336 -ip 43361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4284 -ip 42841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4180 -ip 41801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1456 -ip 14561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 864 -ip 8641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 4523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5140 -ip 51401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 55962F122BABC00A8AD5D6E3A5E2BB58 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FA855FCC61477230CD47B638D4423F20 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A4C5D61FF41EBA07880F828E71A29EC5 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 154E6238FE42D8CE3B7E56B363FA31342⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default3⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"4⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exeC:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff9f801dec0,0x7ff9f801ded0,0x7ff9f801dee05⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exeC:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff6b3e39e70,0x7ff6b3e39e80,0x7ff6b3e39e906⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1576 /prefetch:25⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --mojo-platform-channel-handle=1816 /prefetch:85⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --mojo-platform-channel-handle=2084 /prefetch:85⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2492 /prefetch:15⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2512 /prefetch:15⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2896 /prefetch:25⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --mojo-platform-channel-handle=3460 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --mojo-platform-channel-handle=3664 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --mojo-platform-channel-handle=3668 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --mojo-platform-channel-handle=3396 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe"C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,390341708504535714,4586069948060592632,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5268_297750407" --mojo-platform-channel-handle=3404 /prefetch:85⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_901B.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"3⤵
- Blocklisted process makes network request
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 540 -p 3936 -ip 39361⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 2940 -ip 29401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 3924 -ip 39241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1604 -ip 16041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 6100 -ip 61001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5260 -ip 52601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Users\Admin\AppData\Local\Temp\F6D9.exeC:\Users\Admin\AppData\Local\Temp\F6D9.exe1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\FCB6.exeC:\Users\Admin\AppData\Local\Temp\FCB6.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2762⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2256 -ip 22561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\1F7.exeC:\Users\Admin\AppData\Local\Temp\1F7.exe1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 2362⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\478.exeC:\Users\Admin\AppData\Local\Temp\478.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\478.exeC:\Users\Admin\AppData\Local\Temp\478.exe2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\478.exe"3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 5140 -ip 51401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc1⤵
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable2⤵
-
C:\Users\Admin\AppData\Local\Temp\5A2B.exeC:\Users\Admin\AppData\Local\Temp\5A2B.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 2762⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4240 -ip 42401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 8762⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4796 -ip 47961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\setup_install.exeMD5
a3ca32ebdba2c07c2d386bb31cbd6d51
SHA1e7841e1f475f922d5264b5ce5d123a1b3927f9e6
SHA2560ab2a0bdb8e7a72b5eacb1af5325036266987c5d00b13a981c95754a94f55b1b
SHA512c8abd3a0c8004c11462bf139a873311333cbe6c26046810844199f67d6dd9d7196a7e168261013c50bcb9f24a6bdd37879f617d7aa2089d2a067cb6ca09cbaea
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_1.exeMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_1.txtMD5
6e43430011784cff369ea5a5ae4b000f
SHA15999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f
SHA256a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a
SHA51233ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_2.exeMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_2.txtMD5
18ffdaa7a2c9906db10ffc13f7c73d23
SHA1f195661bc0f9735d02fbe0e937bfd80cf0bcb11f
SHA256365bbeb36a288d829c8dc0f1bf7f70949dd10474586cfc7123c1503256b9e5c3
SHA512db1f81c5b6cac59d6e58e8ab4020bdef7386fa1aa7297f57f693334b70d3dd553ab844f85f92e9903b667cae19f30f188f84939ac0bba2f5999d5bf89793ea34
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_3.exeMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_3.txtMD5
ee658be7ea7269085f4004d68960e547
SHA1979afc4726af14d9079b6cf288686b0e7e4a17e5
SHA256d7e078e3e520767a92acb1eaadf4c7ef75f30e215be4dddfebe684c2504c6fe3
SHA512fc77c079d152b595e249c13b9b0ca97d525407e228c416630a2565707eaacd6805fe1a1c6029b0032d493ae5b67c7d566cc19ab317d9c8e56dfdabc3646d5b1e
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_4.exeMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_4.txtMD5
6765fe4e4be8c4daf3763706a58f42d0
SHA1cebb504bfc3097a95d40016f01123b275c97d58c
SHA256755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60
SHA512c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_5.exeMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_5.txtMD5
0c3f670f496ffcf516fe77d2a161a6ee
SHA10c59d3494b38d768fe120e0a4ca2a1dca7567e6e
SHA2568ed9f410b41e51f09304e5cdadc4d61f82562c9ee15be810e063f2f568812dd0
SHA512bce80fa77557683645480ec28bf5f3a4facb780728d709166890c18decb2095509f69c524e4ce5fbcb48788961554be0467dc78db70f1fd2d242dbd5922a1095
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_6.exeMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\7zS8CBEFCA3\sonia_6.txtMD5
2eb68e495e4eb18c86a443b2754bbab2
SHA182a535e1277ea7a80b809cfeb97dcfb5a5d48a37
SHA256a9083c13dd04bf55cc8e29ab4fe8a0053edf3ffe9b1e5ec31db207a45a98aaaf
SHA512f7dc8d9a8726a6da6226a059094fcaf45190b2b41e6fae7d2aa48eacbd1dfc3b871770c74b1504801f5e7a05f1e3b47ac13cffc8190089f3d07e5c55aa725898
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
99ab358c6f267b09d7a596548654a6ba
SHA1d5a643074b69be2281a168983e3f6bef7322f676
SHA256586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380
SHA512952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
a174d42aebd9b07b023f7508e05c279b
SHA1f70cd24ba0b5b801a04111a9c5b5ec324926c7c3
SHA256fef48e8c21cc4c8f7ebf5580d2488df5793dba5589c7e042934ea1a0b4c9beb2
SHA5124897e43aedf30651a450ed3e978c35e76e51d9f001ddf9353d62a8f375cb2f5caf203603dc463a9bf6f1f866b0943acd00734a222fce17721705d7e3329825ef
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
74231678f536a19b3016840f56b845c7
SHA1a5645777558a7d5905e101e54d61b0c8c1120de3
SHA256cd53d44c68b4b58f88aa945ca38dd18e0a66c3f0854f5868fbea4345f7819fb4
SHA5124117ad2bcdca9104ca8a53df0f7de102509ba6eb264d025ab1facd7a7ca0c14a1c4dd17de130521c4169aaaaeb6e779579dcb16d63a58b77feebfdc32d983d1f
-
C:\Users\Admin\Documents\1fLK4HrOTgyWAhALwwv0FRVL.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\1fLK4HrOTgyWAhALwwv0FRVL.exeMD5
9499dac59e041d057327078ccada8329
SHA1707088977b09835d2407f91f4f6dbe4a4c8f2fff
SHA256ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9
SHA5129d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397
-
C:\Users\Admin\Documents\A7FuV_srshyeLzgToDNfiOYA.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\A7FuV_srshyeLzgToDNfiOYA.exeMD5
2654d11f2d3ce974e432ad1c84bcd1f7
SHA1053efdc46790dd1b49e93863df59c83c39342c8f
SHA256df52242510b70aa54d66b0626624066ece6f8bd5384aa4897778bddfae321c51
SHA5128b577ed49b7648d67ac7ad19cefdad52eb3665d42561e7b97034607ab1d0e7eb2d0fa22a3338717a2c19e12b9826c338e0f66fcdef3cc9ad6d105c95a0b00df7
-
C:\Users\Admin\Documents\C2HMYKJylTBmpIOVMqSSJj5S.exeMD5
f550d370e8256649934a6c9052b0803c
SHA1cb7bc0a067bbbe77b306b87e2b4d3f0e9ce89175
SHA256175b0b3d82bc46f9178ca9051066496e464d846270f5abc7d2b5db01233efbc5
SHA512c19ef1e5d893ec8f53bdec76f6f6c23a712d53035c99cb2a9bef23899896d4be1a03378f512fce3c8fd87edbadc5f12fea8b1efbdec164dbd373632933f5b2b9
-
C:\Users\Admin\Documents\C2HMYKJylTBmpIOVMqSSJj5S.exeMD5
f550d370e8256649934a6c9052b0803c
SHA1cb7bc0a067bbbe77b306b87e2b4d3f0e9ce89175
SHA256175b0b3d82bc46f9178ca9051066496e464d846270f5abc7d2b5db01233efbc5
SHA512c19ef1e5d893ec8f53bdec76f6f6c23a712d53035c99cb2a9bef23899896d4be1a03378f512fce3c8fd87edbadc5f12fea8b1efbdec164dbd373632933f5b2b9
-
C:\Users\Admin\Documents\EHCSjZkQ9to0zuvbSv2EMvXJ.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\EHCSjZkQ9to0zuvbSv2EMvXJ.exeMD5
a6ef5e293c9422d9a4838178aea19c50
SHA193b6d38cc9376fa8710d2df61ae591e449e71b85
SHA25694ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0
SHA512b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454
-
C:\Users\Admin\Documents\GcfaqmHGKpUcuIXW3qzlmP51.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\GcfaqmHGKpUcuIXW3qzlmP51.exeMD5
6083371a04d8e7a2639746dc7978a62b
SHA1df280c12f41e54c82ff0f86aec875795257e45ce
SHA256eee2c4346d2835ece149394040f1d85bb9b8469c02d8ddbbc1b12b570bd1c015
SHA51231680e4ac17a35c276fc1582f3c435c304332a589e57082d970d3c98133401567f66726c975450d4a0712b198b40d057b87664c2bff14ebcf8b61e0a2f616b42
-
C:\Users\Admin\Documents\N1NWVEaMNE_wc3IcbJIXX0Zb.exeMD5
060e727c298a99826cabfacfee33321f
SHA1c94a1ab7b04f8f3bcba8538a901c7ae5f253c9aa
SHA256440fe79cbaf72137d3062df26751a1c8cf8b0e1ce56ad66d4fac66cf56cf6a02
SHA5126baddb62b3a6e592a2009c00029180a2eddb5e07773c900d0adbd29aeea2306586102493ecd18832b06254702a59be97933f38b78e8529d18e8e720896c30ef5
-
C:\Users\Admin\Documents\Rhciu3BLpDoZf6SGJLGjxGlE.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\Rhciu3BLpDoZf6SGJLGjxGlE.exeMD5
8b0f6235ecca70f12b2af9fc99abf208
SHA14241eabb630b9846ab003fda6f3a8f39df423496
SHA25695bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933
SHA5129f62349a5284c33cd7ba204139eb97131e8cb435a76dfbc9458b2278166872a4f304016458945a457a915797a1695e58c92add81dfd4a43cde111a207303df3b
-
C:\Users\Admin\Documents\Up8u6bt1kvmCBZ5hEXSLZ91H.exeMD5
ab8781ed006eff23e2f4391e9d87d33c
SHA1d557dc317e733bcc896a08158c4bc978b524c689
SHA2566543fb158c4d0ace63d292da67d86920914c57280adeb9726694cb7805f7466b
SHA51273c8f4b37d076e2d8606375d3bbc821ccaab5b82ba68e8b2aad48881dcb893ce218334cdaa026acc426080599794240157a6e56ceaa2979276e8e983dfc61a69
-
C:\Users\Admin\Documents\Up8u6bt1kvmCBZ5hEXSLZ91H.exeMD5
ab8781ed006eff23e2f4391e9d87d33c
SHA1d557dc317e733bcc896a08158c4bc978b524c689
SHA2566543fb158c4d0ace63d292da67d86920914c57280adeb9726694cb7805f7466b
SHA51273c8f4b37d076e2d8606375d3bbc821ccaab5b82ba68e8b2aad48881dcb893ce218334cdaa026acc426080599794240157a6e56ceaa2979276e8e983dfc61a69
-
C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\VKg6JumlIYA5aDXV7ctn7nLS.exeMD5
90eb803d0e395eab28a6dc39a7504cc4
SHA17a0410c3b8827a9542003982308c5ad06fdf473f
SHA2561c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd
SHA512d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835
-
C:\Users\Admin\Documents\hf92vg9lOrb9yf59yEw0nT99.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\hf92vg9lOrb9yf59yEw0nT99.exeMD5
54ce8822fbf1cdb94c28d12ccd82f8f9
SHA17077757f069fe0ebd338aeff700cab323e3ab235
SHA2560984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2
SHA512183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435
-
C:\Users\Admin\Documents\jW2zFNgCyb7z4MbUQrhESnjn.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\jW2zFNgCyb7z4MbUQrhESnjn.exeMD5
9d39cbeb9a1394fbdf12f882f68bc161
SHA1371ac387179eb7bbfa2e6710560fd0ac76ff6956
SHA256057d52075dae0fd0ad8dfce142978a92220e6c1894d0e58ab0b03bedbe7645ce
SHA5128cb493b6eba5e9d80116466bb96a9dcabaf3f496c337ca356c99060d9d743286d66a5412d5e9e8e7cde860eaf7307a68fe45a6a1bbe2978c58e6a8b9e498d69f
-
C:\Users\Admin\Documents\k_nC9QIMxbuqGCFsy9nEyeYs.exeMD5
0f73a44e00e05a2257c26a0ab3eb84ab
SHA19c90dac9386f8ef2a44fac90f154a42173461a60
SHA256d256af9cf801950977e5c289587c7c9664d75d0d36e8b19c55e5e9b0ec0312a5
SHA512a3d479ad86ca6dd16298311f5244fc74e9c8711a8dc7bc45bb7f247e911e037f3258a353e2059538170b32800f9665593b7d4a3d7707770a7f79e5cc62bc0261
-
C:\Users\Admin\Documents\kr4UZwTcSFk5fJ94r4F2QbTj.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\kr4UZwTcSFk5fJ94r4F2QbTj.exeMD5
d8b2a0b440b26c2dc3032e3f0de38b72
SHA1ceca844eba2a784e4fbdac0e9377df9d4b9a668b
SHA25655da2aa80bd64db9aebd250ce15446ab248255669e64ef3353b7eaae000c6241
SHA512abc9c8fb1553ab00ed7b628e8810f3e700e07ef9c159eac91bef527531b2c92ac1631d5d81f11c4dfc57687ed2d6b00f6b14195a3024c683d4e27b2d84a75cb3
-
C:\Users\Admin\Documents\rAeuqqH7W_E8N4sD4i2Mamj5.exeMD5
f8d92d2f91fd134e57b6764c0eba5de3
SHA11ed71b2e5a398c1c1bc5f33cfe462d471a48fa52
SHA256420379eae2cab153a4f538c5c9b68d848e78d5c336c8e7e13a923913eb9ba32c
SHA51247d514492022932bb03f771d51bb1909235f9ebf7152b502e2412052628ff85c0342de42b4da8644c820b8bcf1e52fcace0fbc82c32c6216b4c2da56cf5eac71
-
C:\Users\Admin\Documents\zOhH0yARG6ZLOdj96Qqn1DsI.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
C:\Users\Admin\Documents\zOhH0yARG6ZLOdj96Qqn1DsI.exeMD5
fce7591a4edab9b6536e377cb6140486
SHA1bb4ad63d6501a4729b2a74a745e660497066a6c3
SHA2565f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
SHA51259c9c2da699c08d370ac2bcb47d15f25c4a7c37c9d40c02049607a5bfd816c09991f7e1dd10fae84722395b85ce63cadb09893e14c703259098f60163a5988b2
-
memory/580-284-0x0000000000000000-mapping.dmp
-
memory/580-295-0x0000000000400000-0x000000000067D000-memory.dmpFilesize
2.5MB
-
memory/660-279-0x0000000000980000-0x0000000000995000-memory.dmpFilesize
84KB
-
memory/660-434-0x0000000000000000-mapping.dmp
-
memory/660-291-0x00000000009C0000-0x00000000009C2000-memory.dmpFilesize
8KB
-
memory/660-217-0x0000000000000000-mapping.dmp
-
memory/660-262-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/724-197-0x0000000000000000-mapping.dmp
-
memory/812-424-0x0000000000000000-mapping.dmp
-
memory/864-232-0x0000000000000000-mapping.dmp
-
memory/864-451-0x00000000015E0000-0x0000000001F06000-memory.dmpFilesize
9.1MB
-
memory/872-175-0x0000000000000000-mapping.dmp
-
memory/1008-435-0x0000000000000000-mapping.dmp
-
memory/1008-512-0x00000259A46E0000-0x00000259A47AD000-memory.dmpFilesize
820KB
-
memory/1008-513-0x00000259A48E0000-0x00000259A4A12000-memory.dmpFilesize
1.2MB
-
memory/1140-334-0x0000000005AD0000-0x0000000005AD1000-memory.dmpFilesize
4KB
-
memory/1140-345-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/1140-289-0x0000000000000000-mapping.dmp
-
memory/1140-297-0x00000000031F0000-0x000000000322C000-memory.dmpFilesize
240KB
-
memory/1140-298-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/1140-307-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/1140-402-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/1140-393-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/1140-400-0x0000000005B50000-0x0000000005B51000-memory.dmpFilesize
4KB
-
memory/1140-306-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/1140-395-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/1140-389-0x0000000005B20000-0x0000000005B21000-memory.dmpFilesize
4KB
-
memory/1140-376-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/1140-381-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/1140-370-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/1140-313-0x0000000005A80000-0x0000000005A81000-memory.dmpFilesize
4KB
-
memory/1140-330-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/1140-325-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/1140-317-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/1140-311-0x0000000005A70000-0x0000000005A71000-memory.dmpFilesize
4KB
-
memory/1140-321-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/1176-185-0x0000000000000000-mapping.dmp
-
memory/1268-183-0x0000000000000000-mapping.dmp
-
memory/1364-428-0x0000000000000000-mapping.dmp
-
memory/1456-422-0x0000000000000000-mapping.dmp
-
memory/1456-447-0x0000000004A50000-0x0000000004AE3000-memory.dmpFilesize
588KB
-
memory/1460-319-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1460-223-0x0000000000000000-mapping.dmp
-
memory/1460-397-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/1544-491-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/1596-303-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/1596-340-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/1596-226-0x0000000000000000-mapping.dmp
-
memory/1596-312-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/1596-315-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/1596-308-0x00000000060D0000-0x00000000060D1000-memory.dmpFilesize
4KB
-
memory/1596-310-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/1604-417-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/1604-388-0x0000000000000000-mapping.dmp
-
memory/1708-549-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/1712-490-0x000000001B710000-0x000000001B712000-memory.dmpFilesize
8KB
-
memory/1712-430-0x0000000000000000-mapping.dmp
-
memory/1724-456-0x0000000000000000-mapping.dmp
-
memory/1724-473-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1764-486-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/1764-371-0x0000000000000000-mapping.dmp
-
memory/1920-413-0x0000000000000000-mapping.dmp
-
memory/2112-200-0x000000001B150000-0x000000001B152000-memory.dmpFilesize
8KB
-
memory/2112-195-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/2112-186-0x0000000000000000-mapping.dmp
-
memory/2184-245-0x0000000000000000-mapping.dmp
-
memory/2396-446-0x0000000000000000-mapping.dmp
-
memory/2456-193-0x0000000000000000-mapping.dmp
-
memory/2456-202-0x0000000000A50000-0x0000000000A59000-memory.dmpFilesize
36KB
-
memory/2524-220-0x0000000000000000-mapping.dmp
-
memory/2524-273-0x0000000001400000-0x0000000001412000-memory.dmpFilesize
72KB
-
memory/2524-243-0x00000000013E0000-0x00000000013F0000-memory.dmpFilesize
64KB
-
memory/2724-467-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/2724-329-0x0000000000000000-mapping.dmp
-
memory/2812-277-0x00000000010B0000-0x00000000010C5000-memory.dmpFilesize
84KB
-
memory/2812-265-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/2812-240-0x0000000000000000-mapping.dmp
-
memory/2812-285-0x000000001B610000-0x000000001B612000-memory.dmpFilesize
8KB
-
memory/2940-343-0x0000000000000000-mapping.dmp
-
memory/2940-384-0x000000001ADD0000-0x000000001ADD2000-memory.dmpFilesize
8KB
-
memory/3000-174-0x0000000000000000-mapping.dmp
-
memory/3016-146-0x0000000000000000-mapping.dmp
-
memory/3188-177-0x0000000000000000-mapping.dmp
-
memory/3192-288-0x00000000056B0000-0x00000000056C6000-memory.dmpFilesize
88KB
-
memory/3192-323-0x0000000002D90000-0x0000000002E10000-memory.dmpFilesize
512KB
-
memory/3192-358-0x0000000008270000-0x00000000082F0000-memory.dmpFilesize
512KB
-
memory/3192-318-0x0000000008270000-0x0000000008280000-memory.dmpFilesize
64KB
-
memory/3192-314-0x0000000002D90000-0x0000000002DA0000-memory.dmpFilesize
64KB
-
memory/3304-488-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/3304-353-0x0000000000000000-mapping.dmp
-
memory/3380-355-0x0000000000000000-mapping.dmp
-
memory/3452-359-0x0000000000000000-mapping.dmp
-
memory/3536-439-0x0000000000000000-mapping.dmp
-
memory/3548-178-0x0000000000000000-mapping.dmp
-
memory/3560-176-0x0000000000000000-mapping.dmp
-
memory/3704-167-0x0000000000400000-0x000000000051D000-memory.dmpFilesize
1.1MB
-
memory/3704-165-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3704-179-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3704-151-0x0000000000000000-mapping.dmp
-
memory/3704-164-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3704-184-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3704-182-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3704-166-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3704-181-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3732-365-0x0000000000000000-mapping.dmp
-
memory/3752-283-0x0000000000000000-mapping.dmp
-
memory/3752-287-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3824-441-0x0000000000000000-mapping.dmp
-
memory/3892-354-0x000001E98EA10000-0x000001E98EADF000-memory.dmpFilesize
828KB
-
memory/3892-350-0x000001E98E9A0000-0x000001E98EA0E000-memory.dmpFilesize
440KB
-
memory/3892-282-0x0000000000000000-mapping.dmp
-
memory/3924-357-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/3924-344-0x0000000000000000-mapping.dmp
-
memory/3924-419-0x0000000002BB0000-0x0000000002BB2000-memory.dmpFilesize
8KB
-
memory/3936-309-0x0000000000000000-mapping.dmp
-
memory/3936-361-0x000000001AF00000-0x000000001AF02000-memory.dmpFilesize
8KB
-
memory/3936-347-0x00000000009E0000-0x00000000009E1000-memory.dmpFilesize
4KB
-
memory/3936-316-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4000-219-0x0000000000000000-mapping.dmp
-
memory/4000-258-0x0000000002E50000-0x0000000002E59000-memory.dmpFilesize
36KB
-
memory/4044-222-0x0000000000000000-mapping.dmp
-
memory/4044-367-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/4044-301-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/4180-204-0x0000000000000000-mapping.dmp
-
memory/4180-215-0x0000000000000000-mapping.dmp
-
memory/4180-337-0x0000000000BB0000-0x0000000000BDF000-memory.dmpFilesize
188KB
-
memory/4272-199-0x0000000000000000-mapping.dmp
-
memory/4284-221-0x0000000000000000-mapping.dmp
-
memory/4284-268-0x0000000004A10000-0x0000000004AAD000-memory.dmpFilesize
628KB
-
memory/4336-229-0x0000000000000000-mapping.dmp
-
memory/4336-263-0x0000000004A40000-0x0000000004ADD000-memory.dmpFilesize
628KB
-
memory/4376-459-0x0000000000000000-mapping.dmp
-
memory/4412-208-0x0000000000000000-mapping.dmp
-
memory/4496-203-0x0000000000C50000-0x0000000000CED000-memory.dmpFilesize
628KB
-
memory/4496-189-0x0000000000000000-mapping.dmp
-
memory/4500-190-0x0000000000000000-mapping.dmp
-
memory/4584-281-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/4584-276-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/4584-296-0x0000000004D20000-0x00000000052C6000-memory.dmpFilesize
5.6MB
-
memory/4584-216-0x0000000000000000-mapping.dmp
-
memory/4584-293-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/4584-264-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/4584-274-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/4584-290-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4584-278-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4592-149-0x0000000000000000-mapping.dmp
-
memory/4764-212-0x0000000000000000-mapping.dmp
-
memory/4836-292-0x0000000000000000-mapping.dmp
-
memory/4840-294-0x000000001B410000-0x000000001B412000-memory.dmpFilesize
8KB
-
memory/4840-255-0x0000000000000000-mapping.dmp
-
memory/4908-237-0x0000000000000000-mapping.dmp
-
memory/4908-261-0x0000000002D70000-0x0000000002D7A000-memory.dmpFilesize
40KB
-
memory/4924-218-0x0000000000000000-mapping.dmp
-
memory/4924-302-0x000001E108D50000-0x000001E108E1F000-memory.dmpFilesize
828KB
-
memory/4924-299-0x000001E108CE0000-0x000001E108D4F000-memory.dmpFilesize
444KB
-
memory/4988-180-0x0000000000000000-mapping.dmp
-
memory/5004-271-0x0000000000000000-mapping.dmp
-
memory/5004-275-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5260-544-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/5680-515-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/6100-546-0x0000000002450000-0x0000000002452000-memory.dmpFilesize
8KB