Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2022, 18:56

General

  • Target

    file.exe

  • Size

    380KB

  • MD5

    e91e8a603108c29db5d1a1ba1c8123fd

  • SHA1

    e609bf5881c00aa4c325a2250407d0d8b254e04c

  • SHA256

    d026b0f1bfa1ea1bc142695477450d6bd4c10e6d7cdbff1d4e8abaad8f04b6c1

  • SHA512

    2d0c23f0a9cc784820291595816ec49a9f12d3b4bdd5cc569f56810d1766fb73b9a1a8ece293210678d03ebe8d3413bb9ebc7ae9eb757588345bebcd4e8abff7

  • SSDEEP

    6144:x/QiQXCWkm+ksmpk3U9j0IV/OGBfj/WUplm6zIOYQNd28pTXdAmpCLVRZoglM7LT:pQi3WP6m6UR0IV/lL//plmW9bTXeVhD4

Malware Config

Extracted

Family

nymaim

C2

45.139.105.171

85.31.46.167

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 9 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 17 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Users\Admin\AppData\Local\Temp\is-KLCGP.tmp\file.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KLCGP.tmp\file.tmp" /SL5="$B01EE,140559,56832,C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5084
      • C:\Users\Admin\AppData\Local\Temp\is-SDHAQ.tmp\PowerOff.exe
        "C:\Users\Admin\AppData\Local\Temp\is-SDHAQ.tmp\PowerOff.exe" /S /UID=95
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Users\Admin\AppData\Local\Temp\e2-f7026-4ff-76e9b-76a700cb88449\Cewaezhokakae.exe
          "C:\Users\Admin\AppData\Local\Temp\e2-f7026-4ff-76e9b-76a700cb88449\Cewaezhokakae.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4468
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
            5⤵
            • Adds Run key to start application
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4856
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7fff768a46f8,0x7fff768a4708,0x7fff768a4718
              6⤵
                PID:4208
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
                6⤵
                  PID:1340
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                  6⤵
                    PID:3708
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
                    6⤵
                      PID:2528
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                      6⤵
                        PID:4592
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                        6⤵
                          PID:1796
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4868 /prefetch:8
                          6⤵
                            PID:4192
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
                            6⤵
                              PID:3984
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
                              6⤵
                                PID:2148
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5972 /prefetch:8
                                6⤵
                                  PID:4008
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
                                  6⤵
                                    PID:8828
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
                                    6⤵
                                      PID:8844
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
                                      6⤵
                                        PID:7056
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                        6⤵
                                        • Drops file in Program Files directory
                                        PID:7172
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff619bd5460,0x7ff619bd5470,0x7ff619bd5480
                                          7⤵
                                            PID:7268
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
                                          6⤵
                                            PID:7752
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
                                            6⤵
                                              PID:8080
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1436 /prefetch:8
                                              6⤵
                                                PID:8152
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1284 /prefetch:8
                                                6⤵
                                                  PID:8204
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1812 /prefetch:8
                                                  6⤵
                                                    PID:8272
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
                                                    6⤵
                                                      PID:8324
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2124,2332373969867998222,4931086607262259436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5188 /prefetch:8
                                                      6⤵
                                                        PID:8436
                                                  • C:\Users\Admin\AppData\Local\Temp\d5-cff69-118-0c0b8-2b0be0f0374f8\Cewaezhokakae.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\d5-cff69-118-0c0b8-2b0be0f0374f8\Cewaezhokakae.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Checks computer location settings
                                                    • Modifies system certificate store
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4724
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yx4ehuhy.pxm\GcleanerEU.exe /eufive & exit
                                                      5⤵
                                                        PID:8916
                                                        • C:\Users\Admin\AppData\Local\Temp\yx4ehuhy.pxm\GcleanerEU.exe
                                                          C:\Users\Admin\AppData\Local\Temp\yx4ehuhy.pxm\GcleanerEU.exe /eufive
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Checks computer location settings
                                                          PID:4540
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 460
                                                            7⤵
                                                            • Program crash
                                                            PID:6020
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 764
                                                            7⤵
                                                            • Program crash
                                                            PID:6432
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 772
                                                            7⤵
                                                            • Program crash
                                                            PID:6520
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 836
                                                            7⤵
                                                            • Program crash
                                                            PID:6668
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 844
                                                            7⤵
                                                            • Program crash
                                                            PID:6784
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 988
                                                            7⤵
                                                            • Program crash
                                                            PID:6940
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 1020
                                                            7⤵
                                                            • Program crash
                                                            PID:7040
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 1368
                                                            7⤵
                                                            • Program crash
                                                            PID:7256
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\yx4ehuhy.pxm\GcleanerEU.exe" & exit
                                                            7⤵
                                                              PID:7476
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /im "GcleanerEU.exe" /f
                                                                8⤵
                                                                • Kills process with taskkill
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:7584
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ugyvfm1e.fcg\gcleaner.exe /mixfive & exit
                                                          5⤵
                                                            PID:5852
                                                            • C:\Users\Admin\AppData\Local\Temp\ugyvfm1e.fcg\gcleaner.exe
                                                              C:\Users\Admin\AppData\Local\Temp\ugyvfm1e.fcg\gcleaner.exe /mixfive
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Checks computer location settings
                                                              PID:5932
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 452
                                                                7⤵
                                                                • Program crash
                                                                PID:6168
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 764
                                                                7⤵
                                                                • Program crash
                                                                PID:6564
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 772
                                                                7⤵
                                                                • Program crash
                                                                PID:6684
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 792
                                                                7⤵
                                                                • Program crash
                                                                PID:6860
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 804
                                                                7⤵
                                                                • Program crash
                                                                PID:6980
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 1020
                                                                7⤵
                                                                • Program crash
                                                                PID:7132
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 1020
                                                                7⤵
                                                                • Program crash
                                                                PID:7332
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5932 -s 1348
                                                                7⤵
                                                                • Program crash
                                                                PID:7424
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ugyvfm1e.fcg\gcleaner.exe" & exit
                                                                7⤵
                                                                  PID:7632
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /im "gcleaner.exe" /f
                                                                    8⤵
                                                                    • Kills process with taskkill
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:7684
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe & exit
                                                              5⤵
                                                                PID:6040
                                                                • C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Checks computer location settings
                                                                  PID:6100
                                                                  • C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe" -q
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:6244
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uj2br53a.m3i\pb1117.exe & exit
                                                                5⤵
                                                                  PID:6284
                                                                  • C:\Users\Admin\AppData\Local\Temp\uj2br53a.m3i\pb1117.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\uj2br53a.m3i\pb1117.exe
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    PID:6348
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c start https://iplogger.com/1bvgU4.gif
                                                                4⤵
                                                                  PID:1436
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.com/1bvgU4.gif
                                                                    5⤵
                                                                      PID:1400
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff768a46f8,0x7fff768a4708,0x7fff768a4718
                                                                        6⤵
                                                                          PID:1432
                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                1⤵
                                                                  PID:4024
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4540 -ip 4540
                                                                  1⤵
                                                                    PID:5984
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5932 -ip 5932
                                                                    1⤵
                                                                      PID:6128
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4540 -ip 4540
                                                                      1⤵
                                                                        PID:6412
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4540 -ip 4540
                                                                        1⤵
                                                                          PID:6500
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5932 -ip 5932
                                                                          1⤵
                                                                            PID:6540
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4540 -ip 4540
                                                                            1⤵
                                                                              PID:6632
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5932 -ip 5932
                                                                              1⤵
                                                                                PID:6652
                                                                              • C:\Windows\system32\rundll32.exe
                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                1⤵
                                                                                • Process spawned unexpected child process
                                                                                PID:6720
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                  2⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:6740
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 6740 -s 600
                                                                                    3⤵
                                                                                    • Program crash
                                                                                    PID:6872
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4540 -ip 4540
                                                                                1⤵
                                                                                  PID:6764
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6740 -ip 6740
                                                                                  1⤵
                                                                                    PID:6824
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5932 -ip 5932
                                                                                    1⤵
                                                                                      PID:6840
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4540 -ip 4540
                                                                                      1⤵
                                                                                        PID:6920
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5932 -ip 5932
                                                                                        1⤵
                                                                                          PID:6604
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4540 -ip 4540
                                                                                          1⤵
                                                                                            PID:7020
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5932 -ip 5932
                                                                                            1⤵
                                                                                              PID:7072
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4540 -ip 4540
                                                                                              1⤵
                                                                                                PID:7204
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5932 -ip 5932
                                                                                                1⤵
                                                                                                  PID:7248
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5932 -ip 5932
                                                                                                  1⤵
                                                                                                    PID:7400

                                                                                                  Network

                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                          Filesize

                                                                                                          152B

                                                                                                          MD5

                                                                                                          f647a9024e00f209b4882586b48a6d1c

                                                                                                          SHA1

                                                                                                          825a1e51260086c4261315dbc9704e1848fe5ff7

                                                                                                          SHA256

                                                                                                          77614c9d1cb42c41c0ce0415aecc9a20823ba79bdcdb8a27e90be7a16c57229b

                                                                                                          SHA512

                                                                                                          84961cc97defa398b0053b40453db58198b3e5bd2ad59770707ed11eb282eff479664253e616427826b40377e6486cdc1676369324617e5b5b0262b904f2ca9a

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe

                                                                                                          Filesize

                                                                                                          923KB

                                                                                                          MD5

                                                                                                          964da73180a995495797e2107c4b936a

                                                                                                          SHA1

                                                                                                          d941ec8cb8d06c07f77d1c5318abeda5f23ab730

                                                                                                          SHA256

                                                                                                          1ae013d4e99c5bc1b818e14963f275caada1f71fa0186834dc7680124aea8b8d

                                                                                                          SHA512

                                                                                                          6252c809c8aefa1ef8c6742a3099970c6af178a878eba3dd9ef557df62ce6903b9ccf00be534d2b9c1f9b8ffdb4cceed8cc6e5b257b2abe7efcd0a155fe7efa7

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe

                                                                                                          Filesize

                                                                                                          923KB

                                                                                                          MD5

                                                                                                          964da73180a995495797e2107c4b936a

                                                                                                          SHA1

                                                                                                          d941ec8cb8d06c07f77d1c5318abeda5f23ab730

                                                                                                          SHA256

                                                                                                          1ae013d4e99c5bc1b818e14963f275caada1f71fa0186834dc7680124aea8b8d

                                                                                                          SHA512

                                                                                                          6252c809c8aefa1ef8c6742a3099970c6af178a878eba3dd9ef557df62ce6903b9ccf00be534d2b9c1f9b8ffdb4cceed8cc6e5b257b2abe7efcd0a155fe7efa7

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\brcknfvh.5gr\random.exe

                                                                                                          Filesize

                                                                                                          923KB

                                                                                                          MD5

                                                                                                          964da73180a995495797e2107c4b936a

                                                                                                          SHA1

                                                                                                          d941ec8cb8d06c07f77d1c5318abeda5f23ab730

                                                                                                          SHA256

                                                                                                          1ae013d4e99c5bc1b818e14963f275caada1f71fa0186834dc7680124aea8b8d

                                                                                                          SHA512

                                                                                                          6252c809c8aefa1ef8c6742a3099970c6af178a878eba3dd9ef557df62ce6903b9ccf00be534d2b9c1f9b8ffdb4cceed8cc6e5b257b2abe7efcd0a155fe7efa7

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d5-cff69-118-0c0b8-2b0be0f0374f8\Cewaezhokakae.exe

                                                                                                          Filesize

                                                                                                          358KB

                                                                                                          MD5

                                                                                                          7d742eb4667ab6dcf933fa6908b3fb98

                                                                                                          SHA1

                                                                                                          95dc2bdcf018074356a9dccdce4173b90649fd84

                                                                                                          SHA256

                                                                                                          ed72c7dd4305b314ecc097beca33750d40088072cbdca4f18b3e02c2b810e81c

                                                                                                          SHA512

                                                                                                          3df327ae1b405f2b12384315a8742544b78f9869e0d53bc3a58bb96065d651b1092576816512ff2866d0d32025739739f6380a6c1cd70b4b09eb2b7ac52de9b4

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d5-cff69-118-0c0b8-2b0be0f0374f8\Cewaezhokakae.exe

                                                                                                          Filesize

                                                                                                          358KB

                                                                                                          MD5

                                                                                                          7d742eb4667ab6dcf933fa6908b3fb98

                                                                                                          SHA1

                                                                                                          95dc2bdcf018074356a9dccdce4173b90649fd84

                                                                                                          SHA256

                                                                                                          ed72c7dd4305b314ecc097beca33750d40088072cbdca4f18b3e02c2b810e81c

                                                                                                          SHA512

                                                                                                          3df327ae1b405f2b12384315a8742544b78f9869e0d53bc3a58bb96065d651b1092576816512ff2866d0d32025739739f6380a6c1cd70b4b09eb2b7ac52de9b4

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d5-cff69-118-0c0b8-2b0be0f0374f8\Cewaezhokakae.exe.config

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          98d2687aec923f98c37f7cda8de0eb19

                                                                                                          SHA1

                                                                                                          f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

                                                                                                          SHA256

                                                                                                          8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

                                                                                                          SHA512

                                                                                                          95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\d5-cff69-118-0c0b8-2b0be0f0374f8\Kenessey.txt

                                                                                                          Filesize

                                                                                                          9B

                                                                                                          MD5

                                                                                                          97384261b8bbf966df16e5ad509922db

                                                                                                          SHA1

                                                                                                          2fc42d37fee2c81d767e09fb298b70c748940f86

                                                                                                          SHA256

                                                                                                          9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c

                                                                                                          SHA512

                                                                                                          b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db.dat

                                                                                                          Filesize

                                                                                                          557KB

                                                                                                          MD5

                                                                                                          76c3dbb1e9fea62090cdf53dadcbe28e

                                                                                                          SHA1

                                                                                                          d44b32d04adc810c6df258be85dc6b62bd48a307

                                                                                                          SHA256

                                                                                                          556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860

                                                                                                          SHA512

                                                                                                          de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                          Filesize

                                                                                                          52KB

                                                                                                          MD5

                                                                                                          845a5f94673e266f80fae41538a94db1

                                                                                                          SHA1

                                                                                                          a8ed5ba958b94eb55a44f20a4791a58b76e91f0c

                                                                                                          SHA256

                                                                                                          3d73e4425bb7294f20ef86096504ab96d288bd70d2bc6a8361b629903f3b1d01

                                                                                                          SHA512

                                                                                                          f01450a61a6b2daec92fab31c9f153c76574f169f3fef2c6d0cf9283cf730a099c9b7c0cbc4ac44cc4d3c067565a49b8135aa85b745ea340a9d5f8c9dc5c3f81

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                          Filesize

                                                                                                          52KB

                                                                                                          MD5

                                                                                                          845a5f94673e266f80fae41538a94db1

                                                                                                          SHA1

                                                                                                          a8ed5ba958b94eb55a44f20a4791a58b76e91f0c

                                                                                                          SHA256

                                                                                                          3d73e4425bb7294f20ef86096504ab96d288bd70d2bc6a8361b629903f3b1d01

                                                                                                          SHA512

                                                                                                          f01450a61a6b2daec92fab31c9f153c76574f169f3fef2c6d0cf9283cf730a099c9b7c0cbc4ac44cc4d3c067565a49b8135aa85b745ea340a9d5f8c9dc5c3f81

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e2-f7026-4ff-76e9b-76a700cb88449\Cewaezhokakae.exe

                                                                                                          Filesize

                                                                                                          586KB

                                                                                                          MD5

                                                                                                          436e921da691211e16a1adb9ff4d90cd

                                                                                                          SHA1

                                                                                                          6f64647c26bc9d98367618f185fbcfc7717d2851

                                                                                                          SHA256

                                                                                                          5f96df0fb078c706569a49150cf1674f2d6e94cefec73b39a19275ea9a3ac7c6

                                                                                                          SHA512

                                                                                                          493c08bebef58d516461c9fc9249ab7d27a129c4e8bece05c45cbfb0e757c0a132173b41f7ed3dd0a7d0576acfc7113f4c389f894607d1f6498742ec6f3a5369

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e2-f7026-4ff-76e9b-76a700cb88449\Cewaezhokakae.exe

                                                                                                          Filesize

                                                                                                          586KB

                                                                                                          MD5

                                                                                                          436e921da691211e16a1adb9ff4d90cd

                                                                                                          SHA1

                                                                                                          6f64647c26bc9d98367618f185fbcfc7717d2851

                                                                                                          SHA256

                                                                                                          5f96df0fb078c706569a49150cf1674f2d6e94cefec73b39a19275ea9a3ac7c6

                                                                                                          SHA512

                                                                                                          493c08bebef58d516461c9fc9249ab7d27a129c4e8bece05c45cbfb0e757c0a132173b41f7ed3dd0a7d0576acfc7113f4c389f894607d1f6498742ec6f3a5369

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e2-f7026-4ff-76e9b-76a700cb88449\Cewaezhokakae.exe.config

                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          98d2687aec923f98c37f7cda8de0eb19

                                                                                                          SHA1

                                                                                                          f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

                                                                                                          SHA256

                                                                                                          8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

                                                                                                          SHA512

                                                                                                          95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-KLCGP.tmp\file.tmp

                                                                                                          Filesize

                                                                                                          694KB

                                                                                                          MD5

                                                                                                          ffcf263a020aa7794015af0edee5df0b

                                                                                                          SHA1

                                                                                                          bce1eb5f0efb2c83f416b1782ea07c776666fdab

                                                                                                          SHA256

                                                                                                          1d07cfb7104b85fc0dffd761f6848ad176117e146bbb4079fe993efa06b94c64

                                                                                                          SHA512

                                                                                                          49f2b062adfb99c0c7f1012c56f0b52a8850d9f030cc32073b90025b372e4eb373f06a351e9b33264967427b8174c060c8a6110979f0eaf0872f7da6d5e4308a

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-SDHAQ.tmp\PowerOff.exe

                                                                                                          Filesize

                                                                                                          576KB

                                                                                                          MD5

                                                                                                          cfa7c46797e6d113d41adbd97fe38755

                                                                                                          SHA1

                                                                                                          96b1836c44b6aae601c05d547ebf4a79e6361e4b

                                                                                                          SHA256

                                                                                                          ccac7fb768ac6e7f1868de19d0f61454e355b319d332089382f256968dddeb5b

                                                                                                          SHA512

                                                                                                          8f748abb6124c7d2924507aba6239a383d7c170ee5fb1b0fe322c2f6d75f0fb959bab7a94ba99643cfda9bed8402fc3362881232a485d75e0ebee6cee758a6ad

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-SDHAQ.tmp\PowerOff.exe

                                                                                                          Filesize

                                                                                                          576KB

                                                                                                          MD5

                                                                                                          cfa7c46797e6d113d41adbd97fe38755

                                                                                                          SHA1

                                                                                                          96b1836c44b6aae601c05d547ebf4a79e6361e4b

                                                                                                          SHA256

                                                                                                          ccac7fb768ac6e7f1868de19d0f61454e355b319d332089382f256968dddeb5b

                                                                                                          SHA512

                                                                                                          8f748abb6124c7d2924507aba6239a383d7c170ee5fb1b0fe322c2f6d75f0fb959bab7a94ba99643cfda9bed8402fc3362881232a485d75e0ebee6cee758a6ad

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-SDHAQ.tmp\idp.dll

                                                                                                          Filesize

                                                                                                          216KB

                                                                                                          MD5

                                                                                                          8f995688085bced38ba7795f60a5e1d3

                                                                                                          SHA1

                                                                                                          5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                          SHA256

                                                                                                          203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                          SHA512

                                                                                                          043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ugyvfm1e.fcg\gcleaner.exe

                                                                                                          Filesize

                                                                                                          404KB

                                                                                                          MD5

                                                                                                          94cf983d41cc69f6a67371770a48c0ec

                                                                                                          SHA1

                                                                                                          76c27034dba34863a3cc6c3c6e9966cebec0990d

                                                                                                          SHA256

                                                                                                          73aa861f2ac4ba1af21d78bd169a2887c436941eb5a82baedbaed556c4583eb6

                                                                                                          SHA512

                                                                                                          b17b2fc672cc401e901289fe2873f6ce03c36f014392c040374f002bc76040a23c184731d7a37ad96c32b915d2ca091b881469cf164f50298a88b537572d91c8

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ugyvfm1e.fcg\gcleaner.exe

                                                                                                          Filesize

                                                                                                          404KB

                                                                                                          MD5

                                                                                                          94cf983d41cc69f6a67371770a48c0ec

                                                                                                          SHA1

                                                                                                          76c27034dba34863a3cc6c3c6e9966cebec0990d

                                                                                                          SHA256

                                                                                                          73aa861f2ac4ba1af21d78bd169a2887c436941eb5a82baedbaed556c4583eb6

                                                                                                          SHA512

                                                                                                          b17b2fc672cc401e901289fe2873f6ce03c36f014392c040374f002bc76040a23c184731d7a37ad96c32b915d2ca091b881469cf164f50298a88b537572d91c8

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\uj2br53a.m3i\pb1117.exe

                                                                                                          Filesize

                                                                                                          3.5MB

                                                                                                          MD5

                                                                                                          cdea279da102299e2bafb4ecc16b6c58

                                                                                                          SHA1

                                                                                                          732fede49b6e97859389b36895a07bea5d9ad9b9

                                                                                                          SHA256

                                                                                                          e2ad80fc97e02a207df083a6ed19776397bc7024456f1b3a6effdf2d13ac3284

                                                                                                          SHA512

                                                                                                          876075209ce64f71addb70ab9ba27a0cc142d4e1d43d23e10073d06f0bca3dd4a5b41800872f3a3b7044e96f6ed593c42ed32fd799cd825aefa6239694d6b1a4

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\uj2br53a.m3i\pb1117.exe

                                                                                                          Filesize

                                                                                                          3.5MB

                                                                                                          MD5

                                                                                                          cdea279da102299e2bafb4ecc16b6c58

                                                                                                          SHA1

                                                                                                          732fede49b6e97859389b36895a07bea5d9ad9b9

                                                                                                          SHA256

                                                                                                          e2ad80fc97e02a207df083a6ed19776397bc7024456f1b3a6effdf2d13ac3284

                                                                                                          SHA512

                                                                                                          876075209ce64f71addb70ab9ba27a0cc142d4e1d43d23e10073d06f0bca3dd4a5b41800872f3a3b7044e96f6ed593c42ed32fd799cd825aefa6239694d6b1a4

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yx4ehuhy.pxm\GcleanerEU.exe

                                                                                                          Filesize

                                                                                                          404KB

                                                                                                          MD5

                                                                                                          94cf983d41cc69f6a67371770a48c0ec

                                                                                                          SHA1

                                                                                                          76c27034dba34863a3cc6c3c6e9966cebec0990d

                                                                                                          SHA256

                                                                                                          73aa861f2ac4ba1af21d78bd169a2887c436941eb5a82baedbaed556c4583eb6

                                                                                                          SHA512

                                                                                                          b17b2fc672cc401e901289fe2873f6ce03c36f014392c040374f002bc76040a23c184731d7a37ad96c32b915d2ca091b881469cf164f50298a88b537572d91c8

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\yx4ehuhy.pxm\GcleanerEU.exe

                                                                                                          Filesize

                                                                                                          404KB

                                                                                                          MD5

                                                                                                          94cf983d41cc69f6a67371770a48c0ec

                                                                                                          SHA1

                                                                                                          76c27034dba34863a3cc6c3c6e9966cebec0990d

                                                                                                          SHA256

                                                                                                          73aa861f2ac4ba1af21d78bd169a2887c436941eb5a82baedbaed556c4583eb6

                                                                                                          SHA512

                                                                                                          b17b2fc672cc401e901289fe2873f6ce03c36f014392c040374f002bc76040a23c184731d7a37ad96c32b915d2ca091b881469cf164f50298a88b537572d91c8

                                                                                                        • memory/1232-132-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/1232-171-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/1232-136-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                          Filesize

                                                                                                          80KB

                                                                                                        • memory/1672-166-0x00007FFF7B960000-0x00007FFF7C421000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/1672-170-0x00007FFF7B960000-0x00007FFF7C421000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/1672-141-0x0000000000CF0000-0x0000000000D84000-memory.dmp

                                                                                                          Filesize

                                                                                                          592KB

                                                                                                        • memory/1672-142-0x00007FFF7B960000-0x00007FFF7C421000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.8MB

                                                                                                        • memory/4468-151-0x00007FFF71DF0000-0x00007FFF72826000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.2MB

                                                                                                        • memory/4540-219-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.4MB

                                                                                                        • memory/4540-193-0x0000000000BC3000-0x0000000000BEA000-memory.dmp

                                                                                                          Filesize

                                                                                                          156KB

                                                                                                        • memory/4540-194-0x00000000001C0000-0x0000000000200000-memory.dmp

                                                                                                          Filesize

                                                                                                          256KB

                                                                                                        • memory/4540-195-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.4MB

                                                                                                        • memory/4724-152-0x00007FFF71DF0000-0x00007FFF72826000-memory.dmp

                                                                                                          Filesize

                                                                                                          10.2MB

                                                                                                        • memory/5932-201-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.4MB

                                                                                                        • memory/5932-222-0x0000000000400000-0x0000000000869000-memory.dmp

                                                                                                          Filesize

                                                                                                          4.4MB

                                                                                                        • memory/5932-200-0x00000000008E3000-0x000000000090A000-memory.dmp

                                                                                                          Filesize

                                                                                                          156KB

                                                                                                        • memory/6348-208-0x0000000140000000-0x0000000140615000-memory.dmp

                                                                                                          Filesize

                                                                                                          6.1MB