nymaim | e4693812ae9f334345e2346932d4ceacbc620bfc87d658d7b64b0ce60fbd7f88

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2023, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.exe
Size 521KB
Sample230104-wpgtkacd81
SHA256 93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8
MD5 b4c782a4773d0ebf9a3f5ae21f115788
SHA1 df9543ac47a95ae2e0e1d7a31dabfbdf97e48659
SHA512 11d414b1c52335d57f13eaa654fc3654508ba12ba42de2e1f296c88efb6c3d1e74c402d0c7e14f58b50a98eaa51bc9be65e300eabc9d0f3448427890a98c4313
SSDEEP 12288:kQi3ceLI4OjuBxPnk6tn96m6UR0IYyawo+sdsikeEDmBlyZC3:kQiF7ngHIN8+sdkvmOQ3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim socelars discovery evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

socelars

https://hdbywe.s3.us-west-2.amazonaws.com/sadffew26/

Extracted

Family

nymaim

45.139.105.171
85.31.46.167

Signatures

NyMaim
NyMaim is a malware with various capabilities written in C++ and first seen in 2013.
trojan nymaim

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5600	1868	rundll32.exe	48

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000230b3-202.dat	family_socelars
behavioral2/files/0x00070000000230b3-201.dat	family_socelars

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	yreit((.exe

Executes dropped EXE 12 IoCs

pid	Process
1188	93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp
1124	yreit((.exe
2624	SHacaezhavoqa.exe
3572	poweroff.exe
2856	SHacaezhavoqa.exe
3216	poweroff.tmp
3916	Power Off.exe
4752	GcleanerEU.exe
3756	gcleaner.exe
860	random.exe
4532	random.exe
5172	mp3studios_91.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	GcleanerEU.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	gcleaner.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	yreit((.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	SHacaezhavoqa.exe

Loads dropped DLL 2 IoCs

pid	Process
1188	93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp
5624	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows NT\\SHacaezhavoqa.exe\""	yreit((.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\powerOff\Power Off.exe	poweroff.tmp
File opened for modification	C:\Program Files (x86)\powerOff\unins000.dat	poweroff.tmp
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	mp3studios_91.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	mp3studios_91.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	mp3studios_91.exe
File created	C:\Program Files\Google\ACHGVJWPUI\poweroff.exe	yreit((.exe
File created	C:\Program Files (x86)\powerOff\is-BGO14.tmp	poweroff.tmp
File created	C:\Program Files (x86)\powerOff\is-EDE01.tmp	poweroff.tmp
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	mp3studios_91.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	mp3studios_91.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	mp3studios_91.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	mp3studios_91.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230104190619.pma	setup.exe
File created	C:\Program Files (x86)\Windows NT\SHacaezhavoqa.exe.config	yreit((.exe
File created	C:\Program Files\Google\ACHGVJWPUI\poweroff.exe.config	yreit((.exe
File created	C:\Program Files (x86)\powerOff\unins000.dat	poweroff.tmp
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	mp3studios_91.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	mp3studios_91.exe
File created	C:\Program Files (x86)\Windows NT\SHacaezhavoqa.exe	yreit((.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	mp3studios_91.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\714cd445-bd12-4894-85ec-d3de3847fe0f.tmp	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 19 IoCs

pid	pid_target	Process	procid_target
5364	4752	WerFault.exe	99
5488	3756	WerFault.exe	102
5732	5624	WerFault.exe	128
5952	4752	WerFault.exe	99
6076	4752	WerFault.exe	99
6140	3756	WerFault.exe	102
1712	4752	WerFault.exe	99
4636	3756	WerFault.exe	102
2812	4752	WerFault.exe	99
3184	3756	WerFault.exe	102
5412	4752	WerFault.exe	99
5128	3756	WerFault.exe	102
5888	4752	WerFault.exe	99
2852	3756	WerFault.exe	102
4316	4752	WerFault.exe	99
4276	3756	WerFault.exe	102
5760	3756	WerFault.exe	102
5936	4752	WerFault.exe	99
4492	3756	WerFault.exe	102

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
5884	taskkill.exe
632	taskkill.exe
6136	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	83	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3216	poweroff.tmp
3216	poweroff.tmp
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe
2624	SHacaezhavoqa.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	yreit((.exe
Token: SeDebugPrivilege	2856	SHacaezhavoqa.exe
Token: SeDebugPrivilege	2624	SHacaezhavoqa.exe
Token: SeCreateTokenPrivilege	5172	mp3studios_91.exe
Token: SeAssignPrimaryTokenPrivilege	5172	mp3studios_91.exe
Token: SeLockMemoryPrivilege	5172	mp3studios_91.exe
Token: SeIncreaseQuotaPrivilege	5172	mp3studios_91.exe
Token: SeMachineAccountPrivilege	5172	mp3studios_91.exe
Token: SeTcbPrivilege	5172	mp3studios_91.exe
Token: SeSecurityPrivilege	5172	mp3studios_91.exe
Token: SeTakeOwnershipPrivilege	5172	mp3studios_91.exe
Token: SeLoadDriverPrivilege	5172	mp3studios_91.exe
Token: SeSystemProfilePrivilege	5172	mp3studios_91.exe
Token: SeSystemtimePrivilege	5172	mp3studios_91.exe
Token: SeProfSingleProcessPrivilege	5172	mp3studios_91.exe
Token: SeIncBasePriorityPrivilege	5172	mp3studios_91.exe
Token: SeCreatePagefilePrivilege	5172	mp3studios_91.exe
Token: SeCreatePermanentPrivilege	5172	mp3studios_91.exe
Token: SeBackupPrivilege	5172	mp3studios_91.exe
Token: SeRestorePrivilege	5172	mp3studios_91.exe
Token: SeShutdownPrivilege	5172	mp3studios_91.exe
Token: SeDebugPrivilege	5172	mp3studios_91.exe
Token: SeAuditPrivilege	5172	mp3studios_91.exe
Token: SeSystemEnvironmentPrivilege	5172	mp3studios_91.exe
Token: SeChangeNotifyPrivilege	5172	mp3studios_91.exe
Token: SeRemoteShutdownPrivilege	5172	mp3studios_91.exe
Token: SeUndockPrivilege	5172	mp3studios_91.exe
Token: SeSyncAgentPrivilege	5172	mp3studios_91.exe
Token: SeEnableDelegationPrivilege	5172	mp3studios_91.exe
Token: SeManageVolumePrivilege	5172	mp3studios_91.exe
Token: SeImpersonatePrivilege	5172	mp3studios_91.exe
Token: SeCreateGlobalPrivilege	5172	mp3studios_91.exe
Token: 31	5172	mp3studios_91.exe
Token: 32	5172	mp3studios_91.exe
Token: 33	5172	mp3studios_91.exe
Token: 34	5172	mp3studios_91.exe
Token: 35	5172	mp3studios_91.exe
Token: SeDebugPrivilege	5884	cmd.exe
Token: SeDebugPrivilege	632	taskkill.exe
Token: SeDebugPrivilege	6136	taskkill.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
3216	poweroff.tmp
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe
976	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 1188	2644	93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.exe	79
PID 2644 wrote to memory of 1188	2644	93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.exe	79
PID 2644 wrote to memory of 1188	2644	93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.exe	79
PID 1188 wrote to memory of 1124	1188	93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp	80
PID 1188 wrote to memory of 1124	1188	93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp	80
PID 1124 wrote to memory of 2624	1124	yreit((.exe	84
PID 1124 wrote to memory of 2624	1124	yreit((.exe	84
PID 1124 wrote to memory of 3572	1124	yreit((.exe	85
PID 1124 wrote to memory of 3572	1124	yreit((.exe	85
PID 1124 wrote to memory of 3572	1124	yreit((.exe	85
PID 1124 wrote to memory of 2856	1124	yreit((.exe	86
PID 1124 wrote to memory of 2856	1124	yreit((.exe	86
PID 3572 wrote to memory of 3216	3572	poweroff.exe	87
PID 3572 wrote to memory of 3216	3572	poweroff.exe	87
PID 3572 wrote to memory of 3216	3572	poweroff.exe	87
PID 3216 wrote to memory of 3916	3216	poweroff.tmp	88
PID 3216 wrote to memory of 3916	3216	poweroff.tmp	88
PID 2856 wrote to memory of 4024	2856	SHacaezhavoqa.exe	93
PID 2856 wrote to memory of 4024	2856	SHacaezhavoqa.exe	93
PID 4024 wrote to memory of 2240	4024	msedge.exe	95
PID 4024 wrote to memory of 2240	4024	msedge.exe	95
PID 2624 wrote to memory of 5320	2624	SHacaezhavoqa.exe	97
PID 2624 wrote to memory of 5320	2624	SHacaezhavoqa.exe	97
PID 5320 wrote to memory of 4752	5320	cmd.exe	99
PID 5320 wrote to memory of 4752	5320	cmd.exe	99
PID 5320 wrote to memory of 4752	5320	cmd.exe	99
PID 2624 wrote to memory of 4956	2624	SHacaezhavoqa.exe	100
PID 2624 wrote to memory of 4956	2624	SHacaezhavoqa.exe	100
PID 4956 wrote to memory of 3756	4956	cmd.exe	102
PID 4956 wrote to memory of 3756	4956	cmd.exe	102
PID 4956 wrote to memory of 3756	4956	cmd.exe	102
PID 2624 wrote to memory of 1004	2624	SHacaezhavoqa.exe	103
PID 2624 wrote to memory of 1004	2624	SHacaezhavoqa.exe	103
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105
PID 4024 wrote to memory of 1244	4024	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.exe
"C:\Users\Admin\AppData\Local\Temp\93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\is-5FKOM.tmp\93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5FKOM.tmp\93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp" /SL5="$D0148,254223,170496,C:\Users\Admin\AppData\Local\Temp\93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Users\Admin\AppData\Local\Temp\is-UBIV4.tmp\yreit((.exe
    "C:\Users\Admin\AppData\Local\Temp\is-UBIV4.tmp\yreit((.exe" /S /UID=95
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Checks computer location settings
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\fb-00b5c-b93-38aa4-dd7324320cdf3\SHacaezhavoqa.exe
      "C:\Users\Admin\AppData\Local\Temp\fb-00b5c-b93-38aa4-dd7324320cdf3\SHacaezhavoqa.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fdoglfl3.cpp\GcleanerEU.exe /eufive & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\fdoglfl3.cpp\GcleanerEU.exe
        
        C:\Users\Admin\AppData\Local\Temp\fdoglfl3.cpp\GcleanerEU.exe /eufive
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:4752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 448
        7⤵
        Program crash
        
        PID:5364
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 764
        7⤵
        Program crash
        
        PID:5952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 764
        7⤵
        Program crash
        
        PID:6076
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 796
        7⤵
        Program crash
        
        PID:1712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 824
        7⤵
        Program crash
        
        PID:2812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 984
        7⤵
        Program crash
        
        PID:5412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 996
        7⤵
        Program crash
        
        PID:5888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1272
        7⤵
        Program crash
        
        PID:4316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\fdoglfl3.cpp\GcleanerEU.exe" & exit
        7⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "GcleanerEU.exe" /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1384
        7⤵
        Program crash
        
        PID:5936
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\03chjt30.dgb\gcleaner.exe /mixfive & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\03chjt30.dgb\gcleaner.exe
        
        C:\Users\Admin\AppData\Local\Temp\03chjt30.dgb\gcleaner.exe /mixfive
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:3756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 456
        7⤵
        Program crash
        
        PID:5488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 764
        7⤵
        Program crash
        
        PID:6140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 764
        7⤵
        Program crash
        
        PID:4636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 840
        7⤵
        Program crash
        
        PID:3184
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 848
        7⤵
        Program crash
        
        PID:5128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1008
        7⤵
        Program crash
        
        PID:2852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 808
        7⤵
        Program crash
        
        PID:4276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1364
        7⤵
        Program crash
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\03chjt30.dgb\gcleaner.exe" & exit
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "gcleaner.exe" /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 492
        7⤵
        Program crash
        
        PID:4492
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe & exit
        5⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe
        
        C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe
        6⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:860
        
        C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe" -h
        7⤵
        Executes dropped EXE
        
        PID:4532
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xwtuj2v5.ail\mp3studios_91.exe & exit
        5⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\xwtuj2v5.ail\mp3studios_91.exe
        
        C:\Users\Admin\AppData\Local\Temp\xwtuj2v5.ail\mp3studios_91.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        7⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        8⤵
        Kills process with taskkill
        
        PID:5884
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:976
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba3434f50,0x7ffba3434f60,0x7ffba3434f70
        8⤵
        
        PID:1508
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
        8⤵
        
        PID:5152
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2000 /prefetch:8
        8⤵
        
        PID:5148
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:8
        8⤵
        
        PID:5804
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
        8⤵
        
        PID:5864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2928 /prefetch:1
        8⤵
        
        PID:4908
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
        8⤵
        
        PID:5432
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
        8⤵
        
        PID:6096
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:8
        8⤵
        
        PID:2536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4796 /prefetch:8
        8⤵
        
        PID:3108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:8
        8⤵
        
        PID:2388
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
        8⤵
        
        PID:5652
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
        8⤵
        
        PID:428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:8
        8⤵
        
        PID:5376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5208 /prefetch:8
        8⤵
        
        PID:4392
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
        8⤵
        
        PID:5104
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2800 /prefetch:8
        8⤵
        
        PID:5324
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 /prefetch:8
        8⤵
        
        PID:5568
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
        8⤵
        
        PID:3576
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2836 /prefetch:8
        8⤵
        
        PID:752
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:8
        8⤵
        
        PID:5552
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4640 /prefetch:8
        8⤵
        
        PID:3320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,16695022487338630046,6778321722652701296,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5420 /prefetch:2
        8⤵
        
        PID:5632
  - - C:\Program Files\Google\ACHGVJWPUI\poweroff.exe
      "C:\Program Files\Google\ACHGVJWPUI\poweroff.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\is-QL1EQ.tmp\poweroff.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QL1EQ.tmp\poweroff.tmp" /SL5="$6002C,490199,350720,C:\Program Files\Google\ACHGVJWPUI\poweroff.exe" /VERYSILENT
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3216
      - C:\Program Files (x86)\powerOff\Power Off.exe
        
        "C:\Program Files (x86)\powerOff\Power Off.exe" -silent -desktopShortcut -programMenu
        6⤵
        Executes dropped EXE
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\52-486c0-2de-719a6-3304360eec7b5\SHacaezhavoqa.exe
      "C:\Users\Admin\AppData\Local\Temp\52-486c0-2de-719a6-3304360eec7b5\SHacaezhavoqa.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        5⤵
        Adds Run key to start application
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffba4f146f8,0x7ffba4f14708,0x7ffba4f14718
        6⤵
        
        PID:2240
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        6⤵
        
        PID:1244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
        6⤵
        
        PID:2024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 /prefetch:8
        6⤵
        
        PID:5068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        6⤵
        
        PID:456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
        6⤵
        
        PID:2232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 /prefetch:8
        6⤵
        
        PID:4780
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
        6⤵
        
        PID:4264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4436 /prefetch:8
        6⤵
        
        PID:5384
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
        6⤵
        
        PID:5456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
        6⤵
        
        PID:5480
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
        6⤵
        
        PID:4460
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6240 /prefetch:8
        6⤵
        
        PID:5904
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        6⤵
        Drops file in Program Files directory
        
        PID:4720
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6bb505460,0x7ff6bb505470,0x7ff6bb505480
        7⤵
        
        PID:5568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5712 /prefetch:8
        6⤵
        
        PID:4596
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5696 /prefetch:8
        6⤵
        
        PID:428
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10805434676976041343,17645978604351760781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:2
        6⤵
        
        PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4752 -ip 4752
1⤵
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3756 -ip 3756
1⤵
PID:5408

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
1⤵
- Process spawned unexpected child process
PID:5600
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
  2⤵
  - Loads dropped DLL
  PID:5624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 572
    3⤵
    - Program crash
    PID:5732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5624 -ip 5624
1⤵
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4752 -ip 4752
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4752 -ip 4752
1⤵
PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3756 -ip 3756
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4752 -ip 4752
1⤵
PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3756 -ip 3756
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4752 -ip 4752
1⤵
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3756 -ip 3756
1⤵
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4752 -ip 4752
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3756 -ip 3756
1⤵
PID:5420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4752 -ip 4752
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3756 -ip 3756
1⤵
PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4752 -ip 4752
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3756 -ip 3756
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3756 -ip 3756
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4752 -ip 4752
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3756 -ip 3756
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Software Discovery

T1518

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Power Off.exe

Path C:\Program Files (x86)\powerOff\Power Off.exe
Size 621KB
SHA256 f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457
MD5 8d0b18eb87590fa654da3704092b122b
SHA1 aaf4417695904bd718def564b2c1dae40623cc1d
SHA512 fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828
SSDEEP 3072:paeTGhFvdX34iSh+gP01dM6U7Ho2nZ11YFVagzidIaYKaQFiyC6/sIvdX34iSh+B:p3TSvwo+TI9gNMwsEvwoLTI9AAI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Power Off.exe

Path C:\Program Files (x86)\powerOff\Power Off.exe
Size 621KB
SHA256 f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457
MD5 8d0b18eb87590fa654da3704092b122b
SHA1 aaf4417695904bd718def564b2c1dae40623cc1d
SHA512 fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828
SSDEEP 3072:paeTGhFvdX34iSh+gP01dM6U7Ho2nZ11YFVagzidIaYKaQFiyC6/sIvdX34iSh+B:p3TSvwo+TI9gNMwsEvwoLTI9AAI
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.exe

Path C:\Program Files\Google\ACHGVJWPUI\poweroff.exe
Size 838KB
SHA256 c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed
MD5 c0538198613d60407c75c54c55e69d91
SHA1 a2d713a098bc7b6d245c428dcdeb5614af3b8edd
SHA512 121f882471cd14752a1f806472c89028cc56c90fbfb0b645c26937c417f107d5324250f783310032d4526018c8918cdd06c52325949f78220a9d3bab167e3529
SSDEEP 12288:+Qi3reTWxN15q3ZsRfGGduNOXPTd7yts/G6UWi9P3P5cN1IGh0nqPjU6xg7:+QiuWl55R+OeOX7UeRAP3xcNLeqPjUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.exe

Path C:\Program Files\Google\ACHGVJWPUI\poweroff.exe
Size 838KB
SHA256 c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed
MD5 c0538198613d60407c75c54c55e69d91
SHA1 a2d713a098bc7b6d245c428dcdeb5614af3b8edd
SHA512 121f882471cd14752a1f806472c89028cc56c90fbfb0b645c26937c417f107d5324250f783310032d4526018c8918cdd06c52325949f78220a9d3bab167e3529
SSDEEP 12288:+Qi3reTWxN15q3ZsRfGGduNOXPTd7yts/G6UWi9P3P5cN1IGh0nqPjU6xg7:+QiuWl55R+OeOX7UeRAP3xcNLeqPjUX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html
Size 786B
SHA256 a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e
MD5 9ffe618d587a0685d80e9f8bb7d89d39
SHA1 8e9cae42c911027aafae56f9b1a16eb8dd7a739c
SHA512 a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12
MD5 SHA1 SHA512

Submit Download

icon.png

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png
Size 6KB
SHA256 9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5
MD5 c8d8c174df68910527edabe6b5278f06
SHA1 8ac53b3605fea693b59027b9b471202d150f266f
SHA512 d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c
SSDEEP 192:arFa6ynwcj6POoDbxN9EUQYZRia+ce/lkygkkl0:apa6mhjshD9QYZR3qkr/S
MD5 SHA1 SHA512 SSDEEP

Submit Download

aes.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js
Size 13KB
SHA256 fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a
MD5 4ff108e4584780dce15d610c142c3e62
SHA1 77e4519962e2f6a9fc93342137dbb31c33b76b04
SHA512 d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2
SSDEEP 192:9pQGDuD690MPdz8Ui015ll1I57I2Tru6h0hNmHV+m9eIfyAqYfinNVYEUUFJZmUY:9OiT0wz8Uiw/1S7DegkcHpeIuScZbAX
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js
Size 20KB
SHA256 ded45f1f8fe5ed4587535892538e3df3b1ff9464c2fb02ea1e43b8b505b5e799
MD5 3b2b0377fc507dbf2e5b6bb7265d5e3e
SHA1 1443ca3779ff52d3c63e6f00fcc8dd1ddd840f68
SHA512 483b1494dd3ea33c96bee08864e3a2de29b5976f0c8a55711cee2cbcfaff4a01255de2335f82f6469c6d4df319de2b1847af509ffc2d8b897530c5be0eb5e532
SSDEEP 384:USoPxHMJkY63fr3+smwjVMgSAtcCF1BUMPue4TTAx8d:U1Pd6kY63fr3+smwjVMgSAtcCF1HQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

content.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js
Size 3KB
SHA256 f3f30c5c271f80b0a3a329b11d8e72eb404d0c0dc9c66fa162ca97ccaa1e963c
MD5 f79618c53614380c5fdc545699afe890
SHA1 7804a4621cd9405b6def471f3ebedb07fb17e90a
SHA512 c4e0c4df6ac92351591859a7c4358b3dcd342e00051bf561e68e3fcc2c94fdd8d14bd0a042d88dca33f6c7e952938786378d804f56e84b4eab99e2a5fee96a4c
MD5 SHA1 SHA512

Submit Download

jquery-3.3.1.min.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js
Size 84KB
SHA256 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
MD5 a09e13ee94d51c524b7e2a728c7d4039
SHA1 0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae
SHA512 f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a
SSDEEP 1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5 SHA1 SHA512 SSDEEP

Submit Download

mode-ecb.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js
Size 604B
SHA256 03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a
MD5 23231681d1c6f85fa32e725d6d63b19b
SHA1 f69315530b49ac743b0e012652a3a5efaed94f17
SHA512 36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2
MD5 SHA1 SHA512

Submit Download

pad-nopadding.js

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js
Size 268B
SHA256 282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d
MD5 0f26002ee3b4b4440e5949a969ea7503
SHA1 31fc518828fe4894e8077ec5686dce7b1ed281d7
SHA512 4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json
Size 1KB
SHA256 66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333
MD5 6da6b303170ccfdca9d9e75abbfb59f3
SHA1 1a8070080f50a303f73eba253ba49c1e6d400df6
SHA512 872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 28KB
SHA256 635faa6d0ff8622c910199c4e8747a3c5fa9aea90afc2a3cf3a440a957444f80
MD5 c33c68d74cbea2fcd1a9f8626a8aa304
SHA1 70bc7cc7ab2ae02bc05f50627bd32b8b8c26414d
SHA512 03b59369962084e7923f8c35d8e2957b4d159f7ffa57482cab1f4353588dcaf650ab155caa357e5162cce6d31a6222b41dc0c6042bc2b6bb6539214608b875df
SSDEEP 768:HEL8SnDrhLcL7LlRR1kXqKf/pUZNCgVLH2HfjrU6GyHAh0A:y167LlVyghZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\03chjt30.dgb\gcleaner.exe
Size 434KB
SHA256 c24edd1ee97722888421d8fae65be9bbacdfb5e830c0a42ff00a6e643590db4a
MD5 102a2202f6c4eed0841ec4039b16e381
SHA1 bfe27c203e131acd6550c252f2f5c1a3fb0da6fb
SHA512 7e6193d04038e89a04e4f2a3957f1a3450760992cb6915d6df4abf3e99348c739ff70b763df988bcba5a932f84ed1f3128371528ebbca5449272bbf6b1599468
SSDEEP 6144:FdL/YKNgPNwuVLJXi+pKhwj4alkbG1K0yQlAPoxupmLmzJjT:FdEKgwuVLJXi5yjwH0hmPoxupmLmz
MD5 SHA1 SHA512 SSDEEP

Submit Download

gcleaner.exe

Path C:\Users\Admin\AppData\Local\Temp\03chjt30.dgb\gcleaner.exe
Size 434KB
SHA256 c24edd1ee97722888421d8fae65be9bbacdfb5e830c0a42ff00a6e643590db4a
MD5 102a2202f6c4eed0841ec4039b16e381
SHA1 bfe27c203e131acd6550c252f2f5c1a3fb0da6fb
SHA512 7e6193d04038e89a04e4f2a3957f1a3450760992cb6915d6df4abf3e99348c739ff70b763df988bcba5a932f84ed1f3128371528ebbca5449272bbf6b1599468
SSDEEP 6144:FdL/YKNgPNwuVLJXi+pKhwj4alkbG1K0yQlAPoxupmLmzJjT:FdEKgwuVLJXi5yjwH0hmPoxupmLmz
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHacaezhavoqa.exe

Path C:\Users\Admin\AppData\Local\Temp\52-486c0-2de-719a6-3304360eec7b5\SHacaezhavoqa.exe
Size 586KB
SHA256 2f1a9b94d5fce31cab6e35b22b00e4f73b80582d3635ba113a10b2caa5015431
MD5 208e4cd441cdd40a55ee0fc96316e331
SHA1 cddcd13535391b96c8ec650a22f1503f93ca092c
SHA512 bb7891ab9afbe99ce7f0235c155ebe943f8790fcd7bbe1b4420960c2b703f4c96aae84dd8005704fb79bb7edc0f1e4e3270f12bdce060cb8936b6bad0c814651
SSDEEP 6144:G8IbHzOJT7QxJkLVcu7P3tYzzN3pawX1fUYqdildEchHRYWS:Gz57kZ3JEzxFlfUYqdildEchHRYWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHacaezhavoqa.exe

Path C:\Users\Admin\AppData\Local\Temp\52-486c0-2de-719a6-3304360eec7b5\SHacaezhavoqa.exe
Size 586KB
SHA256 2f1a9b94d5fce31cab6e35b22b00e4f73b80582d3635ba113a10b2caa5015431
MD5 208e4cd441cdd40a55ee0fc96316e331
SHA1 cddcd13535391b96c8ec650a22f1503f93ca092c
SHA512 bb7891ab9afbe99ce7f0235c155ebe943f8790fcd7bbe1b4420960c2b703f4c96aae84dd8005704fb79bb7edc0f1e4e3270f12bdce060cb8936b6bad0c814651
SSDEEP 6144:G8IbHzOJT7QxJkLVcu7P3tYzzN3pawX1fUYqdildEchHRYWS:Gz57kZ3JEzxFlfUYqdildEchHRYWS
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHacaezhavoqa.exe.config

Path C:\Users\Admin\AppData\Local\Temp\52-486c0-2de-719a6-3304360eec7b5\SHacaezhavoqa.exe.config
Size 1KB
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA512 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
MD5 SHA1 SHA512

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe
Size 131KB
SHA256 0c0bdbcea941b4cef850609416ec4f3d3ead6f08f687d96b76dcd5e809bb22b9
MD5 a2480afb729334b3901031d9e17ab2f7
SHA1 263a69f2fafc2212fc6ebc093c1a92222d677c62
SHA512 d0ebe6f6f2e42929fea023e8d9b1793ebb5aa0d502b6de08eaab1722790bdbe164eecea2fd893989d97048cda8e0d9d2fffaf21740814d62a2638a31e12302a6
SSDEEP 3072:wLDfdYjOWlRjd+J3lIV4g4SAacOWdPMbwbNddf7wHx7hzlP:wvdkOhbPMcDN7I7tlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe
Size 131KB
SHA256 0c0bdbcea941b4cef850609416ec4f3d3ead6f08f687d96b76dcd5e809bb22b9
MD5 a2480afb729334b3901031d9e17ab2f7
SHA1 263a69f2fafc2212fc6ebc093c1a92222d677c62
SHA512 d0ebe6f6f2e42929fea023e8d9b1793ebb5aa0d502b6de08eaab1722790bdbe164eecea2fd893989d97048cda8e0d9d2fffaf21740814d62a2638a31e12302a6
SSDEEP 3072:wLDfdYjOWlRjd+J3lIV4g4SAacOWdPMbwbNddf7wHx7hzlP:wvdkOhbPMcDN7I7tlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\5cdbojid.4j4\random.exe
Size 131KB
SHA256 0c0bdbcea941b4cef850609416ec4f3d3ead6f08f687d96b76dcd5e809bb22b9
MD5 a2480afb729334b3901031d9e17ab2f7
SHA1 263a69f2fafc2212fc6ebc093c1a92222d677c62
SHA512 d0ebe6f6f2e42929fea023e8d9b1793ebb5aa0d502b6de08eaab1722790bdbe164eecea2fd893989d97048cda8e0d9d2fffaf21740814d62a2638a31e12302a6
SSDEEP 3072:wLDfdYjOWlRjd+J3lIV4g4SAacOWdPMbwbNddf7wHx7hzlP:wvdkOhbPMcDN7I7tlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dat

Path C:\Users\Admin\AppData\Local\Temp\db.dat
Size 557KB
SHA256 556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860
MD5 76c3dbb1e9fea62090cdf53dadcbe28e
SHA1 d44b32d04adc810c6df258be85dc6b62bd48a307
SHA512 de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b
SSDEEP 12288:FV1e0UgkVT6ZT+3JCnoxgLMoCXwbePLJrH8fwpj:FV1edgkV8T0Cnoxt4ePLJTMwpj
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
MD5 0b35335b70b96d31633d0caa207d71f9
SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

db.dll

Path C:\Users\Admin\AppData\Local\Temp\db.dll
Size 52KB
SHA256 ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6
MD5 0b35335b70b96d31633d0caa207d71f9
SHA1 996c7804fe4d85025e2bd7ea8aa5e33c71518f84
SHA512 ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce
SSDEEP 384:1BTKYF02qk7B4NQvtYFd+4az+K9BFcl8rmsmyk/SzR+1jxYOAzuTHo1AR/Nrvrtb:1BTqqMa+tl8iv/Pjx3E0YqtZlWtVt4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kenessey.txt

Path C:\Users\Admin\AppData\Local\Temp\fb-00b5c-b93-38aa4-dd7324320cdf3\Kenessey.txt
Size 9B
SHA256 9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c
MD5 97384261b8bbf966df16e5ad509922db
SHA1 2fc42d37fee2c81d767e09fb298b70c748940f86
SHA512 b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21
MD5 SHA1 SHA512

Submit Download

SHacaezhavoqa.exe

Path C:\Users\Admin\AppData\Local\Temp\fb-00b5c-b93-38aa4-dd7324320cdf3\SHacaezhavoqa.exe
Size 377KB
SHA256 45570616c6bc66ad969a2b343240794096ce515103abea1eb7d4fbcf099bcebc
MD5 97627b2f5f03f91345b467a2a4b34e1a
SHA1 863ef84ed38a90a5141b381d074f417e3ff0b5fc
SHA512 7a738404b761ad637f0f106144d746d6bc97d03e8adfed4c8a7c60cab22e4b2138dcbf9d185d753b92ad9f3de56689932225fd555ff556dbc6c5269d9600d0c0
SSDEEP 6144:0RZRvtX/QGSCOqPyU69iKcWL2h628Ow5RvJnyojESRjNCa0Z8W5qwTpDbyZSle8x:afMCOqlFn0ewZnyojESRjNCa0Z8W5qwF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHacaezhavoqa.exe

Path C:\Users\Admin\AppData\Local\Temp\fb-00b5c-b93-38aa4-dd7324320cdf3\SHacaezhavoqa.exe
Size 377KB
SHA256 45570616c6bc66ad969a2b343240794096ce515103abea1eb7d4fbcf099bcebc
MD5 97627b2f5f03f91345b467a2a4b34e1a
SHA1 863ef84ed38a90a5141b381d074f417e3ff0b5fc
SHA512 7a738404b761ad637f0f106144d746d6bc97d03e8adfed4c8a7c60cab22e4b2138dcbf9d185d753b92ad9f3de56689932225fd555ff556dbc6c5269d9600d0c0
SSDEEP 6144:0RZRvtX/QGSCOqPyU69iKcWL2h628Ow5RvJnyojESRjNCa0Z8W5qwTpDbyZSle8x:afMCOqlFn0ewZnyojESRjNCa0Z8W5qwF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SHacaezhavoqa.exe.config

Path C:\Users\Admin\AppData\Local\Temp\fb-00b5c-b93-38aa4-dd7324320cdf3\SHacaezhavoqa.exe.config
Size 1KB
SHA256 8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465
MD5 98d2687aec923f98c37f7cda8de0eb19
SHA1 f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7
SHA512 95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590
MD5 SHA1 SHA512

Submit Download

GcleanerEU.exe

Path C:\Users\Admin\AppData\Local\Temp\fdoglfl3.cpp\GcleanerEU.exe
Size 434KB
SHA256 c24edd1ee97722888421d8fae65be9bbacdfb5e830c0a42ff00a6e643590db4a
MD5 102a2202f6c4eed0841ec4039b16e381
SHA1 bfe27c203e131acd6550c252f2f5c1a3fb0da6fb
SHA512 7e6193d04038e89a04e4f2a3957f1a3450760992cb6915d6df4abf3e99348c739ff70b763df988bcba5a932f84ed1f3128371528ebbca5449272bbf6b1599468
SSDEEP 6144:FdL/YKNgPNwuVLJXi+pKhwj4alkbG1K0yQlAPoxupmLmzJjT:FdEKgwuVLJXi5yjwH0hmPoxupmLmz
MD5 SHA1 SHA512 SSDEEP

Submit Download

GcleanerEU.exe

Path C:\Users\Admin\AppData\Local\Temp\fdoglfl3.cpp\GcleanerEU.exe
Size 434KB
SHA256 c24edd1ee97722888421d8fae65be9bbacdfb5e830c0a42ff00a6e643590db4a
MD5 102a2202f6c4eed0841ec4039b16e381
SHA1 bfe27c203e131acd6550c252f2f5c1a3fb0da6fb
SHA512 7e6193d04038e89a04e4f2a3957f1a3450760992cb6915d6df4abf3e99348c739ff70b763df988bcba5a932f84ed1f3128371528ebbca5449272bbf6b1599468
SSDEEP 6144:FdL/YKNgPNwuVLJXi+pKhwj4alkbG1K0yQlAPoxupmLmzJjT:FdEKgwuVLJXi5yjwH0hmPoxupmLmz
MD5 SHA1 SHA512 SSDEEP

Submit Download

93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5FKOM.tmp\93578a9c7067f5a2f64f200756d817d16fc4e021878ac768b3d5aa847c2af2e8.tmp
Size 805KB
SHA256 4748736cfa0ff8f469c483cd864166c943d30ff9c3ba0f8cdf0b6b9378a89456
MD5 bf8662a2311eb606e0549451323fa2ba
SHA1 79fbb3b94c91becb56d531806daab15cba55f31c
SHA512 e191a8a50e97800d3fb3cb449d01f1d06dda36d85845355f68d3038e30c3a2a7aa8d87e29f0f638ae85d2badd68eccc26a279f17fb91a38de2fa14a015ed3cc0
SSDEEP 24576:oQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNaf/7Oyx9Yx:k02rPD37zzH2A6SBIfNafjzc
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QL1EQ.tmp\poweroff.tmp
Size 981KB
SHA256 8c1a062cf83fba41daa86670e9ccdb7b7ae3c913fe6d0343284336d40c394ba0
MD5 01515376348a54ecef04f45b436cb104
SHA1 111e709b21bf56181c83057dafba7b71ed41f1b2
SHA512 8d0a31e3694cec61fb99573e58c3696224a6198060d8bfca020805541789516315867b6b83a5e105703660e03fac4906f95f617dc8a3947d6b7982dfd3baea28
SSDEEP 24576:sQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafSWVyx9eR:Q02rPD37zzH2A6SBIfNafwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

poweroff.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-QL1EQ.tmp\poweroff.tmp
Size 981KB
SHA256 8c1a062cf83fba41daa86670e9ccdb7b7ae3c913fe6d0343284336d40c394ba0
MD5 01515376348a54ecef04f45b436cb104
SHA1 111e709b21bf56181c83057dafba7b71ed41f1b2
SHA512 8d0a31e3694cec61fb99573e58c3696224a6198060d8bfca020805541789516315867b6b83a5e105703660e03fac4906f95f617dc8a3947d6b7982dfd3baea28
SSDEEP 24576:sQYh1yLmSKrPD37zzH2A6QD/IpqggE2CfNafSWVyx9eR:Q02rPD37zzH2A6SBIfNafwC
MD5 SHA1 SHA512 SSDEEP

Submit Download

idp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-UBIV4.tmp\idp.dll
Size 216KB
SHA256 203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
MD5 8f995688085bced38ba7795f60a5e1d3
SHA1 5b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA512 043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
SSDEEP 3072:6XHWOJd5D0ocxYF0+CT4zNHNpwZNjlhBKL/kg/0r4YLuztNJaFlCx:6G6tae7wZNOpiWP
MD5 SHA1 SHA512 SSDEEP

Submit Download

yreit((.exe

Path C:\Users\Admin\AppData\Local\Temp\is-UBIV4.tmp\yreit((.exe
Size 302KB
SHA256 35f7d826be42bcddad36ab6fffab52a393aabdf445cff086861f456bfcee814d
MD5 cc41507ba8ee6cdd0909f513c977df6f
SHA1 eac08a0843d63ffd9b681d91624f1d1424a41c15
SHA512 6a9f0ccb052aa119ff65868a9592c6cee3dd0e481ecf5a3686541ddcdfd3443deb4f03b4f54bdc9a6ff6172a5a3ea2fb9e87671ce06210687935bc73230cbf6b
SSDEEP 6144:QSU1mZDYVR8/vjwCPKCgxLKAeHbcVY7XMzOO8YCAYxGIQeUqLv1KCwfk:LU1iYVROvPKpxLaHEY7XMzOO8YCAYxGg
MD5 SHA1 SHA512 SSDEEP

Submit Download

yreit((.exe

Path C:\Users\Admin\AppData\Local\Temp\is-UBIV4.tmp\yreit((.exe
Size 302KB
SHA256 35f7d826be42bcddad36ab6fffab52a393aabdf445cff086861f456bfcee814d
MD5 cc41507ba8ee6cdd0909f513c977df6f
SHA1 eac08a0843d63ffd9b681d91624f1d1424a41c15
SHA512 6a9f0ccb052aa119ff65868a9592c6cee3dd0e481ecf5a3686541ddcdfd3443deb4f03b4f54bdc9a6ff6172a5a3ea2fb9e87671ce06210687935bc73230cbf6b
SSDEEP 6144:QSU1mZDYVR8/vjwCPKCgxLKAeHbcVY7XMzOO8YCAYxGIQeUqLv1KCwfk:LU1iYVROvPKpxLaHEY7XMzOO8YCAYxGg
MD5 SHA1 SHA512 SSDEEP

Submit Download

mp3studios_91.exe

Path C:\Users\Admin\AppData\Local\Temp\xwtuj2v5.ail\mp3studios_91.exe
Size 1.4MB
SHA256 0d43a5fc48863c31083f2e3d3d5da43bba732b6d97e94998e888a651cdb29ef8
MD5 a40bb121f5653871fbd16a48962b54f3
SHA1 e8809b006a2565657919e303581b17c03ecab41b
SHA512 318229f0809d38f14040ecc6aee94f217bc64d88b9ea9d9a5b3fd11e9ac5b9d6578b8c317c6e467f97b7781c237b37b365e34c5c8341dd7d5bfad7cc636aab6f
SSDEEP 24576:5JSLpwfVWRh0SGQ48Lm2194mKa4qrNdW9NTPjalqqBFD:5up62ESMTjTPjaUqvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

mp3studios_91.exe

Path C:\Users\Admin\AppData\Local\Temp\xwtuj2v5.ail\mp3studios_91.exe
Size 1.4MB
SHA256 0d43a5fc48863c31083f2e3d3d5da43bba732b6d97e94998e888a651cdb29ef8
MD5 a40bb121f5653871fbd16a48962b54f3
SHA1 e8809b006a2565657919e303581b17c03ecab41b
SHA512 318229f0809d38f14040ecc6aee94f217bc64d88b9ea9d9a5b3fd11e9ac5b9d6578b8c317c6e467f97b7781c237b37b365e34c5c8341dd7d5bfad7cc636aab6f
SSDEEP 24576:5JSLpwfVWRh0SGQ48Lm2194mKa4qrNdW9NTPjalqqBFD:5up62ESMTjTPjaUqvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1124-142-0x00007FFBA6E80000-0x00007FFBA7941000-memory.dmp

Download

memory/1124-158-0x00007FFBA6E80000-0x00007FFBA7941000-memory.dmp

Download

memory/1124-141-0x0000000000180000-0x00000000001D2000-memory.dmp

Download

memory/2624-162-0x00007FFBA6F10000-0x00007FFBA7946000-memory.dmp

Download

memory/2644-159-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2644-132-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2644-134-0x0000000000400000-0x0000000000430000-memory.dmp

Download

memory/2856-161-0x00007FFBA6F10000-0x00007FFBA7946000-memory.dmp

Download

memory/3572-149-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3572-160-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3756-237-0x0000000002D1C000-0x0000000002D43000-memory.dmp

Download

memory/3756-238-0x0000000000400000-0x0000000002C5F000-memory.dmp

Download

memory/3756-216-0x0000000002D1C000-0x0000000002D43000-memory.dmp

Download

memory/3756-218-0x0000000000400000-0x0000000002C5F000-memory.dmp

Download

memory/3916-167-0x00007FFBA6F10000-0x00007FFBA7946000-memory.dmp

Download

memory/4752-233-0x0000000002DBC000-0x0000000002DE3000-memory.dmp

Download

memory/4752-205-0x0000000000400000-0x0000000002C5F000-memory.dmp

Download

memory/4752-204-0x0000000002CE0000-0x0000000002D20000-memory.dmp

Download

memory/4752-203-0x0000000002DBC000-0x0000000002DE3000-memory.dmp

Download

memory/4752-235-0x0000000000400000-0x0000000002C5F000-memory.dmp

Download