Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-01-2023 10:58

General

  • Target

    f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9.exe

  • Size

    752KB

  • MD5

    31676b02114e92e2de69d7ea17c307f1

  • SHA1

    529374ccf0c521faf0a32279961a54142f20a44a

  • SHA256

    f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9

  • SHA512

    6b1ddc30454437b193fd473b20fe4a63afd55ff9912a19e3bdb0a1c25fb76ee0c3d48fc616576febd8cdaac7aa600af71847ca379fff931dbf9da0d665e1049d

  • SSDEEP

    12288:VQi3IG+zy2Oc6m6UR0Iqpp1hf39Wkv8xwJA:VQiYG+zy2OzHIqppdUMA

Malware Config

Extracted

Family

gcleaner

C2

45.139.105.171

85.31.46.167

107.182.129.235

171.22.30.106

Signatures

  • Detects LgoogLoader payload 1 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • LgoogLoader

    A downloader capable of dropping and executing other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 19 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9.exe
    "C:\Users\Admin\AppData\Local\Temp\f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\is-4B5H3.tmp\f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-4B5H3.tmp\f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9.tmp" /SL5="$8005E,506127,422400,C:\Users\Admin\AppData\Local\Temp\f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3800
      • C:\Users\Admin\AppData\Local\Temp\is-7EKA4.tmp\sasa.exe
        "C:\Users\Admin\AppData\Local\Temp\is-7EKA4.tmp\sasa.exe" /S /UID=95
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Users\Admin\AppData\Local\Temp\dc-019fa-9be-25592-1469c25916885\Vapuqupuly.exe
          "C:\Users\Admin\AppData\Local\Temp\dc-019fa-9be-25592-1469c25916885\Vapuqupuly.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1092
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rtoy0dah.4m5\GcleanerEU.exe /eufive & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:8336
            • C:\Users\Admin\AppData\Local\Temp\rtoy0dah.4m5\GcleanerEU.exe
              C:\Users\Admin\AppData\Local\Temp\rtoy0dah.4m5\GcleanerEU.exe /eufive
              6⤵
              • Executes dropped EXE
              • Checks computer location settings
              PID:9872
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 468
                7⤵
                • Program crash
                PID:24948
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 768
                7⤵
                • Program crash
                PID:25416
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 812
                7⤵
                • Program crash
                PID:25488
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 768
                7⤵
                • Program crash
                PID:25896
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 788
                7⤵
                • Program crash
                PID:25992
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 984
                7⤵
                • Program crash
                PID:26128
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 1012
                7⤵
                • Program crash
                PID:26276
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 1348
                7⤵
                • Program crash
                PID:26428
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\rtoy0dah.4m5\GcleanerEU.exe" & exit
                7⤵
                  PID:26600
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /im "GcleanerEU.exe" /f
                    8⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:26720
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 9872 -s 1396
                  7⤵
                  • Program crash
                  PID:26688
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aiaqefuy.gaf\gcleaner.exe /mixfive & exit
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:11780
              • C:\Users\Admin\AppData\Local\Temp\aiaqefuy.gaf\gcleaner.exe
                C:\Users\Admin\AppData\Local\Temp\aiaqefuy.gaf\gcleaner.exe /mixfive
                6⤵
                • Executes dropped EXE
                • Checks computer location settings
                PID:24592
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 456
                  7⤵
                  • Program crash
                  PID:25064
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 776
                  7⤵
                  • Program crash
                  PID:25824
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 776
                  7⤵
                  • Program crash
                  PID:25956
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 820
                  7⤵
                  • Program crash
                  PID:26052
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 828
                  7⤵
                  • Program crash
                  PID:26208
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 984
                  7⤵
                  • Program crash
                  PID:26328
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 1016
                  7⤵
                  • Program crash
                  PID:26440
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 1348
                  7⤵
                  • Program crash
                  PID:26632
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\aiaqefuy.gaf\gcleaner.exe" & exit
                  7⤵
                    PID:26792
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /im "gcleaner.exe" /f
                      8⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:26868
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 24592 -s 1388
                    7⤵
                    • Program crash
                    PID:26860
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe & exit
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:24628
                • C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe
                  C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe
                  6⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:24676
                  • C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe
                    "C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe" -h
                    7⤵
                    • Executes dropped EXE
                    PID:24732
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jlwvr5sq.uos\pb1117.exe & exit
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:24788
                • C:\Users\Admin\AppData\Local\Temp\jlwvr5sq.uos\pb1117.exe
                  C:\Users\Admin\AppData\Local\Temp\jlwvr5sq.uos\pb1117.exe
                  6⤵
                  • Executes dropped EXE
                  PID:24924
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\adwkvhmu.bxf\360.exe & exit
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:25160
                • C:\Users\Admin\AppData\Local\Temp\adwkvhmu.bxf\360.exe
                  C:\Users\Admin\AppData\Local\Temp\adwkvhmu.bxf\360.exe
                  6⤵
                  • Executes dropped EXE
                  • Sets service image path in registry
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: LoadsDriver
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:25208
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
                    7⤵
                      PID:25504
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
                      7⤵
                        PID:25516
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
                        7⤵
                          PID:25556
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                          7⤵
                            PID:25564
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
                            7⤵
                              PID:25596
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
                              7⤵
                                PID:25632
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
                                7⤵
                                  PID:25648
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
                                  7⤵
                                    PID:25664
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
                                    7⤵
                                      PID:25656
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
                                      7⤵
                                        PID:25672
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
                                        7⤵
                                          PID:25684
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
                                          7⤵
                                            PID:25700
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
                                            7⤵
                                              PID:25760
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
                                              7⤵
                                                PID:25776
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
                                                7⤵
                                                  PID:25768
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
                                                  7⤵
                                                    PID:25752
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
                                                    7⤵
                                                      PID:25740
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
                                                      7⤵
                                                        PID:25732
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
                                                        7⤵
                                                          PID:25716
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
                                                          7⤵
                                                            PID:25708
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
                                                            7⤵
                                                              PID:25640
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
                                                              7⤵
                                                                PID:25624
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
                                                                7⤵
                                                                  PID:25616
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
                                                                  7⤵
                                                                    PID:25608
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
                                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
                                                                    7⤵
                                                                      PID:25588
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
                                                                      7⤵
                                                                        PID:25580
                                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
                                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
                                                                        7⤵
                                                                          PID:25572
                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                                          7⤵
                                                                            PID:25548
                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
                                                                            7⤵
                                                                              PID:25540
                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
                                                                              7⤵
                                                                                PID:25532
                                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
                                                                                7⤵
                                                                                  PID:25524
                                                                          • C:\Users\Admin\AppData\Local\Temp\95-fc4d1-a22-f8a93-ddc5fc9c02ba6\Vapuqupuly.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\95-fc4d1-a22-f8a93-ddc5fc9c02ba6\Vapuqupuly.exe"
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2232
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                              5⤵
                                                                              • Adds Run key to start application
                                                                              • Enumerates system info in registry
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:27396
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffb91f546f8,0x7ffb91f54708,0x7ffb91f54718
                                                                                6⤵
                                                                                  PID:27416
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
                                                                                  6⤵
                                                                                    PID:27644
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
                                                                                    6⤵
                                                                                      PID:27664
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
                                                                                      6⤵
                                                                                        PID:27784
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                        6⤵
                                                                                          PID:27912
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                                                                          6⤵
                                                                                            PID:27940
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5400 /prefetch:8
                                                                                            6⤵
                                                                                              PID:28188
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                                                                                              6⤵
                                                                                                PID:28288
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3924 /prefetch:8
                                                                                                6⤵
                                                                                                  PID:28376
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                                                                                                  6⤵
                                                                                                    PID:28444
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
                                                                                                    6⤵
                                                                                                      PID:28460
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
                                                                                                      6⤵
                                                                                                        PID:28596
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                                                                        6⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:28648
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7367a5460,0x7ff7367a5470,0x7ff7367a5480
                                                                                                          7⤵
                                                                                                            PID:28692
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1751706885972798457,18413383002622507176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
                                                                                                          6⤵
                                                                                                            PID:28896
                                                                                                      • C:\Program Files\Windows Security\JITJACKGNB\poweroff.exe
                                                                                                        "C:\Program Files\Windows Security\JITJACKGNB\poweroff.exe" /VERYSILENT
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4564
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-CJNG1.tmp\poweroff.tmp
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-CJNG1.tmp\poweroff.tmp" /SL5="$30118,490199,350720,C:\Program Files\Windows Security\JITJACKGNB\poweroff.exe" /VERYSILENT
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:4952
                                                                                                          • C:\Program Files (x86)\powerOff\Power Off.exe
                                                                                                            "C:\Program Files (x86)\powerOff\Power Off.exe" -silent -desktopShortcut -programMenu
                                                                                                            6⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2812
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 9872 -ip 9872
                                                                                                  1⤵
                                                                                                    PID:24872
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 24592 -ip 24592
                                                                                                    1⤵
                                                                                                      PID:25036
                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                                      1⤵
                                                                                                      • Process spawned unexpected child process
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:25280
                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                                                        2⤵
                                                                                                        • Loads dropped DLL
                                                                                                        PID:25296
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 25296 -s 608
                                                                                                          3⤵
                                                                                                          • Program crash
                                                                                                          PID:25400
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 25296 -ip 25296
                                                                                                      1⤵
                                                                                                        PID:25360
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 9872 -ip 9872
                                                                                                        1⤵
                                                                                                          PID:25384
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 9872 -ip 9872
                                                                                                          1⤵
                                                                                                            PID:25468
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 24592 -ip 24592
                                                                                                            1⤵
                                                                                                              PID:25724
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 9872 -ip 9872
                                                                                                              1⤵
                                                                                                                PID:25864
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 24592 -ip 24592
                                                                                                                1⤵
                                                                                                                  PID:25924
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 9872 -ip 9872
                                                                                                                  1⤵
                                                                                                                    PID:25972
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 24592 -ip 24592
                                                                                                                    1⤵
                                                                                                                      PID:26032
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 9872 -ip 9872
                                                                                                                      1⤵
                                                                                                                        PID:26100
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 24592 -ip 24592
                                                                                                                        1⤵
                                                                                                                          PID:26160
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 9872 -ip 9872
                                                                                                                          1⤵
                                                                                                                            PID:26260
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 24592 -ip 24592
                                                                                                                            1⤵
                                                                                                                              PID:26304
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 9872 -ip 9872
                                                                                                                              1⤵
                                                                                                                                PID:26388
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 24592 -ip 24592
                                                                                                                                1⤵
                                                                                                                                  PID:26400
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 24592 -ip 24592
                                                                                                                                  1⤵
                                                                                                                                    PID:26572
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 9872 -ip 9872
                                                                                                                                    1⤵
                                                                                                                                      PID:26620
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 24592 -ip 24592
                                                                                                                                      1⤵
                                                                                                                                        PID:26812
                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:27820

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\Program Files (x86)\powerOff\Power Off.exe

                                                                                                                                          Filesize

                                                                                                                                          621KB

                                                                                                                                          MD5

                                                                                                                                          8d0b18eb87590fa654da3704092b122b

                                                                                                                                          SHA1

                                                                                                                                          aaf4417695904bd718def564b2c1dae40623cc1d

                                                                                                                                          SHA256

                                                                                                                                          f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457

                                                                                                                                          SHA512

                                                                                                                                          fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828

                                                                                                                                        • C:\Program Files (x86)\powerOff\Power Off.exe

                                                                                                                                          Filesize

                                                                                                                                          621KB

                                                                                                                                          MD5

                                                                                                                                          8d0b18eb87590fa654da3704092b122b

                                                                                                                                          SHA1

                                                                                                                                          aaf4417695904bd718def564b2c1dae40623cc1d

                                                                                                                                          SHA256

                                                                                                                                          f9d12723a5ac3ade8212b4ec2f2b8452b7deb10e071bcb4e50a9cb6cb85b1457

                                                                                                                                          SHA512

                                                                                                                                          fa54fad936e96ecabfab70f29fe5095b60ce5bfa7f31f6c405c42ad4f4f153ec7406d03d0451e11e886722abf28f09b219d3e8d9a703f20cb67b0950d8b70828

                                                                                                                                        • C:\Program Files\Windows Security\JITJACKGNB\poweroff.exe

                                                                                                                                          Filesize

                                                                                                                                          838KB

                                                                                                                                          MD5

                                                                                                                                          c0538198613d60407c75c54c55e69d91

                                                                                                                                          SHA1

                                                                                                                                          a2d713a098bc7b6d245c428dcdeb5614af3b8edd

                                                                                                                                          SHA256

                                                                                                                                          c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed

                                                                                                                                          SHA512

                                                                                                                                          121f882471cd14752a1f806472c89028cc56c90fbfb0b645c26937c417f107d5324250f783310032d4526018c8918cdd06c52325949f78220a9d3bab167e3529

                                                                                                                                        • C:\Program Files\Windows Security\JITJACKGNB\poweroff.exe

                                                                                                                                          Filesize

                                                                                                                                          838KB

                                                                                                                                          MD5

                                                                                                                                          c0538198613d60407c75c54c55e69d91

                                                                                                                                          SHA1

                                                                                                                                          a2d713a098bc7b6d245c428dcdeb5614af3b8edd

                                                                                                                                          SHA256

                                                                                                                                          c23f223e4d981eb0e24cadae9dc0c60e40e12ff220d95c9dd2a5b6220fa6d6ed

                                                                                                                                          SHA512

                                                                                                                                          121f882471cd14752a1f806472c89028cc56c90fbfb0b645c26937c417f107d5324250f783310032d4526018c8918cdd06c52325949f78220a9d3bab167e3529

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe

                                                                                                                                          Filesize

                                                                                                                                          160KB

                                                                                                                                          MD5

                                                                                                                                          861253a1ff4bdacab4ddd1a1df3efc50

                                                                                                                                          SHA1

                                                                                                                                          5512ad9b91d5c5972ac0a4c5f0f28d966054807c

                                                                                                                                          SHA256

                                                                                                                                          9a3a87d0f2eeeca3e36bbaef7833c44f20e6162075c7cea9a89bce15d3d2269d

                                                                                                                                          SHA512

                                                                                                                                          39751c804a3ec9184f031d30682caae9232dfa00e0c00c7dbd2e09bc640147822f633593546b249b92be6f8896a1cabb08c8d70888d0082d3735be32f60d8927

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe

                                                                                                                                          Filesize

                                                                                                                                          160KB

                                                                                                                                          MD5

                                                                                                                                          861253a1ff4bdacab4ddd1a1df3efc50

                                                                                                                                          SHA1

                                                                                                                                          5512ad9b91d5c5972ac0a4c5f0f28d966054807c

                                                                                                                                          SHA256

                                                                                                                                          9a3a87d0f2eeeca3e36bbaef7833c44f20e6162075c7cea9a89bce15d3d2269d

                                                                                                                                          SHA512

                                                                                                                                          39751c804a3ec9184f031d30682caae9232dfa00e0c00c7dbd2e09bc640147822f633593546b249b92be6f8896a1cabb08c8d70888d0082d3735be32f60d8927

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\0m4waqgb.aff\chenp.exe

                                                                                                                                          Filesize

                                                                                                                                          160KB

                                                                                                                                          MD5

                                                                                                                                          861253a1ff4bdacab4ddd1a1df3efc50

                                                                                                                                          SHA1

                                                                                                                                          5512ad9b91d5c5972ac0a4c5f0f28d966054807c

                                                                                                                                          SHA256

                                                                                                                                          9a3a87d0f2eeeca3e36bbaef7833c44f20e6162075c7cea9a89bce15d3d2269d

                                                                                                                                          SHA512

                                                                                                                                          39751c804a3ec9184f031d30682caae9232dfa00e0c00c7dbd2e09bc640147822f633593546b249b92be6f8896a1cabb08c8d70888d0082d3735be32f60d8927

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\95-fc4d1-a22-f8a93-ddc5fc9c02ba6\Vapuqupuly.exe

                                                                                                                                          Filesize

                                                                                                                                          586KB

                                                                                                                                          MD5

                                                                                                                                          208e4cd441cdd40a55ee0fc96316e331

                                                                                                                                          SHA1

                                                                                                                                          cddcd13535391b96c8ec650a22f1503f93ca092c

                                                                                                                                          SHA256

                                                                                                                                          2f1a9b94d5fce31cab6e35b22b00e4f73b80582d3635ba113a10b2caa5015431

                                                                                                                                          SHA512

                                                                                                                                          bb7891ab9afbe99ce7f0235c155ebe943f8790fcd7bbe1b4420960c2b703f4c96aae84dd8005704fb79bb7edc0f1e4e3270f12bdce060cb8936b6bad0c814651

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\95-fc4d1-a22-f8a93-ddc5fc9c02ba6\Vapuqupuly.exe

                                                                                                                                          Filesize

                                                                                                                                          586KB

                                                                                                                                          MD5

                                                                                                                                          208e4cd441cdd40a55ee0fc96316e331

                                                                                                                                          SHA1

                                                                                                                                          cddcd13535391b96c8ec650a22f1503f93ca092c

                                                                                                                                          SHA256

                                                                                                                                          2f1a9b94d5fce31cab6e35b22b00e4f73b80582d3635ba113a10b2caa5015431

                                                                                                                                          SHA512

                                                                                                                                          bb7891ab9afbe99ce7f0235c155ebe943f8790fcd7bbe1b4420960c2b703f4c96aae84dd8005704fb79bb7edc0f1e4e3270f12bdce060cb8936b6bad0c814651

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\95-fc4d1-a22-f8a93-ddc5fc9c02ba6\Vapuqupuly.exe.config

                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          98d2687aec923f98c37f7cda8de0eb19

                                                                                                                                          SHA1

                                                                                                                                          f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

                                                                                                                                          SHA256

                                                                                                                                          8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

                                                                                                                                          SHA512

                                                                                                                                          95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\adwkvhmu.bxf\360.exe

                                                                                                                                          Filesize

                                                                                                                                          534KB

                                                                                                                                          MD5

                                                                                                                                          4715769b2a3a90dc8c939aec11c52bc1

                                                                                                                                          SHA1

                                                                                                                                          1a1eeabc9d4758de67016ed1e06defd571107e63

                                                                                                                                          SHA256

                                                                                                                                          7ce366cf2cc3e1787d552e5603568e1ce96496aacef73df9676b9a3fafe660db

                                                                                                                                          SHA512

                                                                                                                                          308badf1be750b58399a3532b452a85cf345d222a1ec48949c99fd5cbe6505a79e8093b72ea117ef8b3963b8ddcbf2812907a5d8535b98c9480bb038fcdfe579

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\adwkvhmu.bxf\360.exe

                                                                                                                                          Filesize

                                                                                                                                          534KB

                                                                                                                                          MD5

                                                                                                                                          4715769b2a3a90dc8c939aec11c52bc1

                                                                                                                                          SHA1

                                                                                                                                          1a1eeabc9d4758de67016ed1e06defd571107e63

                                                                                                                                          SHA256

                                                                                                                                          7ce366cf2cc3e1787d552e5603568e1ce96496aacef73df9676b9a3fafe660db

                                                                                                                                          SHA512

                                                                                                                                          308badf1be750b58399a3532b452a85cf345d222a1ec48949c99fd5cbe6505a79e8093b72ea117ef8b3963b8ddcbf2812907a5d8535b98c9480bb038fcdfe579

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aiaqefuy.gaf\gcleaner.exe

                                                                                                                                          Filesize

                                                                                                                                          301KB

                                                                                                                                          MD5

                                                                                                                                          2d526f97060bdf0ec6d9fa55a64ca7d6

                                                                                                                                          SHA1

                                                                                                                                          e3b7820ac00f18c94e47d1560980c84861ec6325

                                                                                                                                          SHA256

                                                                                                                                          33b115ca78655e139f1b053c6bd75c447ee2b5df6e7feafd15ed088968a9422f

                                                                                                                                          SHA512

                                                                                                                                          8bdd8eaf69defcdd35859c5782a3b6f85b37bde9ea88e061ad00abb9d94a007e873af1fa8b42943ad3bfe7a680dcdd077fe13f7c0f47a888a2ae8a5cf437c934

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\aiaqefuy.gaf\gcleaner.exe

                                                                                                                                          Filesize

                                                                                                                                          301KB

                                                                                                                                          MD5

                                                                                                                                          2d526f97060bdf0ec6d9fa55a64ca7d6

                                                                                                                                          SHA1

                                                                                                                                          e3b7820ac00f18c94e47d1560980c84861ec6325

                                                                                                                                          SHA256

                                                                                                                                          33b115ca78655e139f1b053c6bd75c447ee2b5df6e7feafd15ed088968a9422f

                                                                                                                                          SHA512

                                                                                                                                          8bdd8eaf69defcdd35859c5782a3b6f85b37bde9ea88e061ad00abb9d94a007e873af1fa8b42943ad3bfe7a680dcdd077fe13f7c0f47a888a2ae8a5cf437c934

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db.dat

                                                                                                                                          Filesize

                                                                                                                                          557KB

                                                                                                                                          MD5

                                                                                                                                          76c3dbb1e9fea62090cdf53dadcbe28e

                                                                                                                                          SHA1

                                                                                                                                          d44b32d04adc810c6df258be85dc6b62bd48a307

                                                                                                                                          SHA256

                                                                                                                                          556fd54e5595d222cfa2bd353afa66d8d4d1fbb3003afed604672fceae991860

                                                                                                                                          SHA512

                                                                                                                                          de4ea57497cf26237430880742f59e8d2a0ac7e7a0b09ed7be590f36fbd08c9ced0ffe46eb69ec2215a9cff55720f24fffcae752cd282250b4da6b75a30b3a1b

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                                                          Filesize

                                                                                                                                          52KB

                                                                                                                                          MD5

                                                                                                                                          0b35335b70b96d31633d0caa207d71f9

                                                                                                                                          SHA1

                                                                                                                                          996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                                                                                                                                          SHA256

                                                                                                                                          ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                                                                                                                                          SHA512

                                                                                                                                          ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\db.dll

                                                                                                                                          Filesize

                                                                                                                                          52KB

                                                                                                                                          MD5

                                                                                                                                          0b35335b70b96d31633d0caa207d71f9

                                                                                                                                          SHA1

                                                                                                                                          996c7804fe4d85025e2bd7ea8aa5e33c71518f84

                                                                                                                                          SHA256

                                                                                                                                          ec01d244074f45d4f698f5713147e99d76053824a648b306e1debf69f3ba9ce6

                                                                                                                                          SHA512

                                                                                                                                          ab3d770e99b3f379165863808f3ffc55d64d8e9384a158e6695d7325e97fa1bb570c5088ccdc1d2c3b90df5be11d6722ede15e7b6552bf90e748cb9c28ab94ce

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dc-019fa-9be-25592-1469c25916885\Kenessey.txt

                                                                                                                                          Filesize

                                                                                                                                          9B

                                                                                                                                          MD5

                                                                                                                                          97384261b8bbf966df16e5ad509922db

                                                                                                                                          SHA1

                                                                                                                                          2fc42d37fee2c81d767e09fb298b70c748940f86

                                                                                                                                          SHA256

                                                                                                                                          9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c

                                                                                                                                          SHA512

                                                                                                                                          b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dc-019fa-9be-25592-1469c25916885\Vapuqupuly.exe

                                                                                                                                          Filesize

                                                                                                                                          377KB

                                                                                                                                          MD5

                                                                                                                                          97627b2f5f03f91345b467a2a4b34e1a

                                                                                                                                          SHA1

                                                                                                                                          863ef84ed38a90a5141b381d074f417e3ff0b5fc

                                                                                                                                          SHA256

                                                                                                                                          45570616c6bc66ad969a2b343240794096ce515103abea1eb7d4fbcf099bcebc

                                                                                                                                          SHA512

                                                                                                                                          7a738404b761ad637f0f106144d746d6bc97d03e8adfed4c8a7c60cab22e4b2138dcbf9d185d753b92ad9f3de56689932225fd555ff556dbc6c5269d9600d0c0

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dc-019fa-9be-25592-1469c25916885\Vapuqupuly.exe

                                                                                                                                          Filesize

                                                                                                                                          377KB

                                                                                                                                          MD5

                                                                                                                                          97627b2f5f03f91345b467a2a4b34e1a

                                                                                                                                          SHA1

                                                                                                                                          863ef84ed38a90a5141b381d074f417e3ff0b5fc

                                                                                                                                          SHA256

                                                                                                                                          45570616c6bc66ad969a2b343240794096ce515103abea1eb7d4fbcf099bcebc

                                                                                                                                          SHA512

                                                                                                                                          7a738404b761ad637f0f106144d746d6bc97d03e8adfed4c8a7c60cab22e4b2138dcbf9d185d753b92ad9f3de56689932225fd555ff556dbc6c5269d9600d0c0

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\dc-019fa-9be-25592-1469c25916885\Vapuqupuly.exe.config

                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          98d2687aec923f98c37f7cda8de0eb19

                                                                                                                                          SHA1

                                                                                                                                          f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

                                                                                                                                          SHA256

                                                                                                                                          8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

                                                                                                                                          SHA512

                                                                                                                                          95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-4B5H3.tmp\f0ffe21703f29dd78d6a5f937ddeed8437e9cb4e9a0dce7adf9149e250a98fd9.tmp

                                                                                                                                          Filesize

                                                                                                                                          1.0MB

                                                                                                                                          MD5

                                                                                                                                          a5ea5f8ae934ab6efe216fc1e4d1b6dc

                                                                                                                                          SHA1

                                                                                                                                          cb52a9e2aa2aa0e6e82fa44879055003a91207d7

                                                                                                                                          SHA256

                                                                                                                                          be998499deb4ad2cbb87ff38e372f387baf4da3a15faf6d0a43c5cc137650d9e

                                                                                                                                          SHA512

                                                                                                                                          f13280508fb43734809321f65741351aedd1613c3c989e978147dbb5a59efb02494349fbf6ee96b85de5ad049493d8382372993f3d54b80e84e36edf986e915c

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-7EKA4.tmp\idp.dll

                                                                                                                                          Filesize

                                                                                                                                          216KB

                                                                                                                                          MD5

                                                                                                                                          8f995688085bced38ba7795f60a5e1d3

                                                                                                                                          SHA1

                                                                                                                                          5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                          SHA256

                                                                                                                                          203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                          SHA512

                                                                                                                                          043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-7EKA4.tmp\sasa.exe

                                                                                                                                          Filesize

                                                                                                                                          302KB

                                                                                                                                          MD5

                                                                                                                                          cc41507ba8ee6cdd0909f513c977df6f

                                                                                                                                          SHA1

                                                                                                                                          eac08a0843d63ffd9b681d91624f1d1424a41c15

                                                                                                                                          SHA256

                                                                                                                                          35f7d826be42bcddad36ab6fffab52a393aabdf445cff086861f456bfcee814d

                                                                                                                                          SHA512

                                                                                                                                          6a9f0ccb052aa119ff65868a9592c6cee3dd0e481ecf5a3686541ddcdfd3443deb4f03b4f54bdc9a6ff6172a5a3ea2fb9e87671ce06210687935bc73230cbf6b

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-7EKA4.tmp\sasa.exe

                                                                                                                                          Filesize

                                                                                                                                          302KB

                                                                                                                                          MD5

                                                                                                                                          cc41507ba8ee6cdd0909f513c977df6f

                                                                                                                                          SHA1

                                                                                                                                          eac08a0843d63ffd9b681d91624f1d1424a41c15

                                                                                                                                          SHA256

                                                                                                                                          35f7d826be42bcddad36ab6fffab52a393aabdf445cff086861f456bfcee814d

                                                                                                                                          SHA512

                                                                                                                                          6a9f0ccb052aa119ff65868a9592c6cee3dd0e481ecf5a3686541ddcdfd3443deb4f03b4f54bdc9a6ff6172a5a3ea2fb9e87671ce06210687935bc73230cbf6b

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-CJNG1.tmp\poweroff.tmp

                                                                                                                                          Filesize

                                                                                                                                          981KB

                                                                                                                                          MD5

                                                                                                                                          01515376348a54ecef04f45b436cb104

                                                                                                                                          SHA1

                                                                                                                                          111e709b21bf56181c83057dafba7b71ed41f1b2

                                                                                                                                          SHA256

                                                                                                                                          8c1a062cf83fba41daa86670e9ccdb7b7ae3c913fe6d0343284336d40c394ba0

                                                                                                                                          SHA512

                                                                                                                                          8d0a31e3694cec61fb99573e58c3696224a6198060d8bfca020805541789516315867b6b83a5e105703660e03fac4906f95f617dc8a3947d6b7982dfd3baea28

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-CJNG1.tmp\poweroff.tmp

                                                                                                                                          Filesize

                                                                                                                                          981KB

                                                                                                                                          MD5

                                                                                                                                          01515376348a54ecef04f45b436cb104

                                                                                                                                          SHA1

                                                                                                                                          111e709b21bf56181c83057dafba7b71ed41f1b2

                                                                                                                                          SHA256

                                                                                                                                          8c1a062cf83fba41daa86670e9ccdb7b7ae3c913fe6d0343284336d40c394ba0

                                                                                                                                          SHA512

                                                                                                                                          8d0a31e3694cec61fb99573e58c3696224a6198060d8bfca020805541789516315867b6b83a5e105703660e03fac4906f95f617dc8a3947d6b7982dfd3baea28

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jlwvr5sq.uos\pb1117.exe

                                                                                                                                          Filesize

                                                                                                                                          3.5MB

                                                                                                                                          MD5

                                                                                                                                          0b7434ca22cfd570e60beabbc3ab68ad

                                                                                                                                          SHA1

                                                                                                                                          c988cebc96bc58f76fe6d5a93420798f5b27f4bb

                                                                                                                                          SHA256

                                                                                                                                          48b3b5e521f2b126baedcef1c91827570effa898e054ae6f7e215203454955f4

                                                                                                                                          SHA512

                                                                                                                                          be90bd0cac5eb522b121889020e75d6494005b63dc3af237a8ebd0b27d3ac5a8fac4367289850b704f5b1d79d8afd603d46c9afc3b0c0015e0da18959f9a34bc

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jlwvr5sq.uos\pb1117.exe

                                                                                                                                          Filesize

                                                                                                                                          3.5MB

                                                                                                                                          MD5

                                                                                                                                          0b7434ca22cfd570e60beabbc3ab68ad

                                                                                                                                          SHA1

                                                                                                                                          c988cebc96bc58f76fe6d5a93420798f5b27f4bb

                                                                                                                                          SHA256

                                                                                                                                          48b3b5e521f2b126baedcef1c91827570effa898e054ae6f7e215203454955f4

                                                                                                                                          SHA512

                                                                                                                                          be90bd0cac5eb522b121889020e75d6494005b63dc3af237a8ebd0b27d3ac5a8fac4367289850b704f5b1d79d8afd603d46c9afc3b0c0015e0da18959f9a34bc

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\rtoy0dah.4m5\GcleanerEU.exe

                                                                                                                                          Filesize

                                                                                                                                          301KB

                                                                                                                                          MD5

                                                                                                                                          2d526f97060bdf0ec6d9fa55a64ca7d6

                                                                                                                                          SHA1

                                                                                                                                          e3b7820ac00f18c94e47d1560980c84861ec6325

                                                                                                                                          SHA256

                                                                                                                                          33b115ca78655e139f1b053c6bd75c447ee2b5df6e7feafd15ed088968a9422f

                                                                                                                                          SHA512

                                                                                                                                          8bdd8eaf69defcdd35859c5782a3b6f85b37bde9ea88e061ad00abb9d94a007e873af1fa8b42943ad3bfe7a680dcdd077fe13f7c0f47a888a2ae8a5cf437c934

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\rtoy0dah.4m5\GcleanerEU.exe

                                                                                                                                          Filesize

                                                                                                                                          301KB

                                                                                                                                          MD5

                                                                                                                                          2d526f97060bdf0ec6d9fa55a64ca7d6

                                                                                                                                          SHA1

                                                                                                                                          e3b7820ac00f18c94e47d1560980c84861ec6325

                                                                                                                                          SHA256

                                                                                                                                          33b115ca78655e139f1b053c6bd75c447ee2b5df6e7feafd15ed088968a9422f

                                                                                                                                          SHA512

                                                                                                                                          8bdd8eaf69defcdd35859c5782a3b6f85b37bde9ea88e061ad00abb9d94a007e873af1fa8b42943ad3bfe7a680dcdd077fe13f7c0f47a888a2ae8a5cf437c934

                                                                                                                                        • memory/1092-159-0x00007FFB895C0000-0x00007FFB89FF6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.2MB

                                                                                                                                        • memory/2232-160-0x00007FFB895C0000-0x00007FFB89FF6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.2MB

                                                                                                                                        • memory/2812-168-0x00007FFB895C0000-0x00007FFB89FF6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.2MB

                                                                                                                                        • memory/3464-164-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          436KB

                                                                                                                                        • memory/3464-132-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          436KB

                                                                                                                                        • memory/3464-134-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          436KB

                                                                                                                                        • memory/3464-138-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          436KB

                                                                                                                                        • memory/4564-154-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          368KB

                                                                                                                                        • memory/4564-163-0x0000000000400000-0x000000000045C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          368KB

                                                                                                                                        • memory/4824-142-0x0000000000010000-0x0000000000062000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          328KB

                                                                                                                                        • memory/4824-161-0x00007FFB928C0000-0x00007FFB93381000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/4824-143-0x00007FFB928C0000-0x00007FFB93381000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/9872-193-0x0000000000400000-0x0000000000451000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          324KB

                                                                                                                                        • memory/9872-221-0x0000000000400000-0x0000000000451000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          324KB

                                                                                                                                        • memory/9872-190-0x00000000007FD000-0x0000000000824000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          156KB

                                                                                                                                        • memory/9872-192-0x0000000000710000-0x0000000000750000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          256KB

                                                                                                                                        • memory/9872-220-0x00000000007FD000-0x0000000000824000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          156KB

                                                                                                                                        • memory/24592-222-0x00000000005ED000-0x0000000000614000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          156KB

                                                                                                                                        • memory/24592-201-0x0000000000400000-0x0000000000451000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          324KB

                                                                                                                                        • memory/24592-223-0x0000000000400000-0x0000000000451000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          324KB

                                                                                                                                        • memory/24592-199-0x00000000005ED000-0x0000000000614000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          156KB

                                                                                                                                        • memory/24924-188-0x0000000140000000-0x000000014061C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.1MB

                                                                                                                                        • memory/25208-200-0x000001A7AD510000-0x000001A7AD598000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          544KB

                                                                                                                                        • memory/25208-204-0x000001A7AD8F0000-0x000001A7AD90E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                        • memory/25208-203-0x00007FFB91500000-0x00007FFB91FC1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/25208-202-0x000001A7C8600000-0x000001A7C8676000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          472KB

                                                                                                                                        • memory/25208-213-0x00007FFB91500000-0x00007FFB91FC1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          10.8MB

                                                                                                                                        • memory/25776-209-0x0000000000400000-0x0000000000442000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          264KB

                                                                                                                                        • memory/25776-211-0x0000000000400000-0x0000000000442000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          264KB

                                                                                                                                        • memory/25776-212-0x0000000000400000-0x0000000000442000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          264KB

                                                                                                                                        • memory/25776-215-0x0000000002B00000-0x0000000002B0D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          52KB

                                                                                                                                        • memory/25776-214-0x0000000002AE0000-0x0000000002AE9000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          36KB