63c7a5db3e679333031a9560c43a9f4cec16e17a6f77d54e176819777b39bdad

Resubmissions

14/06/2024, 17:16

240614-vtaqdatbpp10

13/06/2024, 21:34

240613-1e88aa1bqg10

13/06/2024, 15:10

240613-skbj7syamn10

Analysis

max time kernel
74s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 15:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aimware cracked.exe
Size 10.8MB
Sample240613-skbj7syamn
SHA256 63c7a5db3e679333031a9560c43a9f4cec16e17a6f77d54e176819777b39bdad
MD5 f7f77160b40900574a32754c51a25a10
SHA1 ae635ec0973cca142a8a44b7755c038675c099e4
SHA512 3561d353ac73e166949d1de35953a929f0809e4a901113b41c5f9d3dcd9f71612d5a5f9e1eb3ce0aec7bac23591f80ef986ba56fb8fadc97918889b83fa7a6fd
SSDEEP 196608:n55MZxmQI/Z2ZPaQ4+c3JMqCkOLmhL+P/9usexc+7fSyI:nU75I2Vayc3JM7KhL+PKcA6b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	YandexPackLoader.exe

Executes dropped EXE 12 IoCs

pid	Process
1700	aimware cracked.exe
4508	cheatloader.exe
3036	icsys.icn.exe
5116	explorer.exe
3256	spoolsv.exe
5036	svchost.exe
3316	spoolsv.exe
3544	YandexPackLoader.exe
1448	YandexPackSetup.exe
2508	YandexPackLoader.exe
1824	lite_installer.exe
1212	seederexe.exe

Loads dropped DLL 19 IoCs

pid	Process
1700	aimware cracked.exe
1700	aimware cracked.exe
1700	aimware cracked.exe
4508	cheatloader.exe
4508	cheatloader.exe
4508	cheatloader.exe
4508	cheatloader.exe
4508	cheatloader.exe
4508	cheatloader.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe
4052	MsiExec.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FD5.tmp	msiexec.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	C:\Windows\Installer\e586a3e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D1D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6DDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E69.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6EB9.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}	msiexec.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Aimware cracked.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File created	C:\Windows\Installer\e586a3e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E48.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6E89.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F86.tmp	msiexec.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Installer\MSI6D9B.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	YandexPackLoader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackLoader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackLoader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	YandexPackLoader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	YandexPackLoader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	YandexPackLoader.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	YandexPackLoader.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4004	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
4592	Aimware cracked.exe
1700	aimware cracked.exe
1700	aimware cracked.exe
1700	aimware cracked.exe
1700	aimware cracked.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe
3036	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5036	svchost.exe
5116	explorer.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	aimware cracked.exe
Token: SeShutdownPrivilege	1448	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	1448	YandexPackSetup.exe
Token: SeSecurityPrivilege	4560	msiexec.exe
Token: SeCreateTokenPrivilege	1448	YandexPackSetup.exe
Token: SeAssignPrimaryTokenPrivilege	1448	YandexPackSetup.exe
Token: SeLockMemoryPrivilege	1448	YandexPackSetup.exe
Token: SeIncreaseQuotaPrivilege	1448	YandexPackSetup.exe
Token: SeMachineAccountPrivilege	1448	YandexPackSetup.exe
Token: SeTcbPrivilege	1448	YandexPackSetup.exe
Token: SeSecurityPrivilege	1448	YandexPackSetup.exe
Token: SeTakeOwnershipPrivilege	1448	YandexPackSetup.exe
Token: SeLoadDriverPrivilege	1448	YandexPackSetup.exe
Token: SeSystemProfilePrivilege	1448	YandexPackSetup.exe
Token: SeSystemtimePrivilege	1448	YandexPackSetup.exe
Token: SeProfSingleProcessPrivilege	1448	YandexPackSetup.exe
Token: SeIncBasePriorityPrivilege	1448	YandexPackSetup.exe
Token: SeCreatePagefilePrivilege	1448	YandexPackSetup.exe
Token: SeCreatePermanentPrivilege	1448	YandexPackSetup.exe
Token: SeBackupPrivilege	1448	YandexPackSetup.exe
Token: SeRestorePrivilege	1448	YandexPackSetup.exe
Token: SeShutdownPrivilege	1448	YandexPackSetup.exe
Token: SeDebugPrivilege	1448	YandexPackSetup.exe
Token: SeAuditPrivilege	1448	YandexPackSetup.exe
Token: SeSystemEnvironmentPrivilege	1448	YandexPackSetup.exe
Token: SeChangeNotifyPrivilege	1448	YandexPackSetup.exe
Token: SeRemoteShutdownPrivilege	1448	YandexPackSetup.exe
Token: SeUndockPrivilege	1448	YandexPackSetup.exe
Token: SeSyncAgentPrivilege	1448	YandexPackSetup.exe
Token: SeEnableDelegationPrivilege	1448	YandexPackSetup.exe
Token: SeManageVolumePrivilege	1448	YandexPackSetup.exe
Token: SeImpersonatePrivilege	1448	YandexPackSetup.exe
Token: SeCreateGlobalPrivilege	1448	YandexPackSetup.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe
Token: SeRestorePrivilege	4560	msiexec.exe
Token: SeTakeOwnershipPrivilege	4560	msiexec.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
4592	Aimware cracked.exe
4592	Aimware cracked.exe
3036	icsys.icn.exe
4508	cheatloader.exe
3036	icsys.icn.exe
4508	cheatloader.exe
5116	explorer.exe
5116	explorer.exe
3256	spoolsv.exe
3256	spoolsv.exe
5036	svchost.exe
5036	svchost.exe
3316	spoolsv.exe
3316	spoolsv.exe
4508	cheatloader.exe
4508	cheatloader.exe
4508	cheatloader.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 1700	4592	Aimware cracked.exe	83
PID 4592 wrote to memory of 1700	4592	Aimware cracked.exe	83
PID 4592 wrote to memory of 1700	4592	Aimware cracked.exe	83
PID 1700 wrote to memory of 4508	1700	aimware cracked.exe	85
PID 1700 wrote to memory of 4508	1700	aimware cracked.exe	85
PID 1700 wrote to memory of 3300	1700	aimware cracked.exe	86
PID 1700 wrote to memory of 3300	1700	aimware cracked.exe	86
PID 1700 wrote to memory of 3300	1700	aimware cracked.exe	86
PID 4592 wrote to memory of 3036	4592	Aimware cracked.exe	88
PID 4592 wrote to memory of 3036	4592	Aimware cracked.exe	88
PID 4592 wrote to memory of 3036	4592	Aimware cracked.exe	88
PID 3036 wrote to memory of 5116	3036	icsys.icn.exe	89
PID 3036 wrote to memory of 5116	3036	icsys.icn.exe	89
PID 3036 wrote to memory of 5116	3036	icsys.icn.exe	89
PID 3300 wrote to memory of 4004	3300	cmd.exe	90
PID 3300 wrote to memory of 4004	3300	cmd.exe	90
PID 3300 wrote to memory of 4004	3300	cmd.exe	90
PID 5116 wrote to memory of 3256	5116	explorer.exe	91
PID 5116 wrote to memory of 3256	5116	explorer.exe	91
PID 5116 wrote to memory of 3256	5116	explorer.exe	91
PID 3256 wrote to memory of 5036	3256	spoolsv.exe	92
PID 3256 wrote to memory of 5036	3256	spoolsv.exe	92
PID 3256 wrote to memory of 5036	3256	spoolsv.exe	92
PID 5036 wrote to memory of 3316	5036	svchost.exe	93
PID 5036 wrote to memory of 3316	5036	svchost.exe	93
PID 5036 wrote to memory of 3316	5036	svchost.exe	93
PID 4508 wrote to memory of 3544	4508	cheatloader.exe	100
PID 4508 wrote to memory of 3544	4508	cheatloader.exe	100
PID 4508 wrote to memory of 3544	4508	cheatloader.exe	100
PID 3544 wrote to memory of 1448	3544	YandexPackLoader.exe	101
PID 3544 wrote to memory of 1448	3544	YandexPackLoader.exe	101
PID 3544 wrote to memory of 1448	3544	YandexPackLoader.exe	101
PID 3544 wrote to memory of 2508	3544	YandexPackLoader.exe	102
PID 3544 wrote to memory of 2508	3544	YandexPackLoader.exe	102
PID 3544 wrote to memory of 2508	3544	YandexPackLoader.exe	102
PID 4560 wrote to memory of 4052	4560	msiexec.exe	105
PID 4560 wrote to memory of 4052	4560	msiexec.exe	105
PID 4560 wrote to memory of 4052	4560	msiexec.exe	105
PID 4052 wrote to memory of 1824	4052	MsiExec.exe	106
PID 4052 wrote to memory of 1824	4052	MsiExec.exe	106
PID 4052 wrote to memory of 1824	4052	MsiExec.exe	106
PID 4052 wrote to memory of 1212	4052	MsiExec.exe	108
PID 4052 wrote to memory of 1212	4052	MsiExec.exe	108
PID 4052 wrote to memory of 1212	4052	MsiExec.exe	108

C:\Users\Admin\AppData\Local\Temp\Aimware cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Aimware cracked.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592
- \??\c:\users\admin\appdata\local\temp\aimware cracked.exe
  "c:\users\admin\appdata\local\temp\aimware cracked.exe "
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Roaming\Aimware cracked\cheatloader.exe
    "C:\Users\Admin\AppData\Roaming\Aimware cracked\cheatloader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Users\Admin\AppData\Local\YandexPackLoader.exe
      C:\Users\Admin\AppData\Local\YandexPackLoader.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /passive /msicl "VID=699 YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y "
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
    - - C:\Users\Admin\AppData\Local\YandexPackLoader.exe
        
        C:\Users\Admin\AppData\Local\YandexPackLoader.exe --stat dwnldr/p=8981/rid=5d26e555-c30d-4f4d-b039-eea236ecfae8/sbr=0-0/hrc=200-200/bd=267-10639168/gtpr=1-1-1-255-1/cdr=0-b7-b7-ff-b7/for=3-0/fole=255-0/fwle=255-0/vr=ff-0/vle=ff-0/hovr=ff-ff/hovle=ff-ff/shle=ff-0/vmajor=10/vminor=0/vbuild=19041/distr_type=landing/cnt=0/dt=2/ct=0/rt=0 --dh 2348 --st 1718291530
        5⤵
        Executes dropped EXE
        
        PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c deldll.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 -w 1000 127.0.0.1
      4⤵
      Runs ping.exe
      PID:4004
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3036
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3256
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5036
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3316

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A130780DD4E8C52905CF7BACB9D20C45
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Users\Admin\AppData\Local\Temp\8D314215-B82F-4AFE-8260-247227A01E40\lite_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\8D314215-B82F-4AFE-8260-247227A01E40\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER
    3⤵
    - Executes dropped EXE
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\0085E2C8-1A34-4FED-852E-F79557255378\seederexe.exe
    "C:\Users\Admin\AppData\Local\Temp\0085E2C8-1A34-4FED-852E-F79557255378\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\11AC166F-C1CF-46B7-98D8-19AAD6254A9A\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"
    3⤵
    - Executes dropped EXE
    PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586a41.rbs

Path C:\Config.Msi\e586a41.rbs
Size 911B
SHA256 6333e1059da56c72539c84112ee48f350897b57c438fcedfc9c40f14ac38477c
MD5 5027650d5f49e933fa583c44e52769bd
SHA1 4535c61578f638e9e5eccbb19a5e2db2843a712c
SHA512 e6a773e3f7fc5cb5f6e6c4e19472540debc178dc98034b5cd12196a995eb1de7f6ecc291e56a8912dee3c150d25a87eaddeec163c7cef6af0df7a19982a6b69d
MD5 SHA1 SHA512

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 1KB
SHA256 93678a6f1e8f8ef5878e0338490797150f03bda81f3d7aaee5e860a5847de52a
MD5 654d2e602b1e06712daf7c50bad0a7ac
SHA1 0f07f2950eed89dfd5bd46744181aa0b70db48a6
SHA512 1d7ac4a142e9f0313d723231691cb733a5b9c39d79a74a2d3d9771f6afce9ddf3c5cce41cf7252a441d670b21a4d46ab7f9fa6afc008ee9f96fc7ae18217925e
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 f8905fc8c404370d966feff0fb316d3a9a96fd7643b80d2e4ebb69fbe3fac1e4
MD5 ff71724ca94ca286c8b2c1602ed2e7cf
SHA1 170ca7df3991449185abff40999dfea0162dad4a
SHA512 85192f7ad1f9ea4895562f5945e61454609db37feac1cdcbb68072df4c6b243b65690c768b9d9d3fd5bef7908294b95e51daaae929c6a24aed4b125d6735ac10
MD5 SHA1 SHA512

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_394487CAFBCFB8C5917AD7A10924C8A7
Size 536B
SHA256 7bf40599273b96bff014d7e4a5c857972a803004bb88dfc0452c0dd30a29d6d6
MD5 66c364b18d82ddd44b65b1e763b789fe
SHA1 b9cd7f818a92e57915c09cc5b6c0e9c1786bd7dc
SHA512 035a589fb03210b387343a390b48e4e643438f9b6b2aa190ef28b26211e19dc93700fec4c12b1db26413e696b1aea6d8d4369c20db036754854925e878a9e9f8
MD5 SHA1 SHA512

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 a7d065a7b28c0b9efd9f7a2fabf265069ca982119767eef9a70929aaab5d0fa6
MD5 0c6b53a5a762d47bec063de294a45e16
SHA1 149ea40492f75e98016c45cc0c4d0db0cbeffd82
SHA512 8bb0fa0b07e607b533070f76cec917074a93ba94cfb04a18651b625dff5ea1a16079d90b4cfa25c1dda16d6409e4dcf492c7b7e88d82cc46331f23a27cb6096b
MD5 SHA1 SHA512

Submit Download

seederexe.exe

Path C:\Users\Admin\AppData\Local\Temp\0085E2C8-1A34-4FED-852E-F79557255378\seederexe.exe
Size 8.6MB
SHA256 35585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
MD5 225ba20fa3edd13c9c72f600ff90e6cb
SHA1 5f1a9baa85c2afe29619e7cc848036d9174701e4
SHA512 97e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3
SSDEEP 196608:44T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:4CoXrlAJ7N3pXW2uGzy
MD5 SHA1 SHA512 SSDEEP

Submit Download

YandexPackSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe
Size 10.1MB
SHA256 afb3d35762171e821e8f29282b25dacb9c2dc099f2c61ca5ac010e08db475470
MD5 80d2dd34eb0c5904b09339a0d9c7e26e
SHA1 57f990e23660e2f00ef4c10c68fde78210451376
SHA512 ebf83cd70d37e0519a5f942a06e052ff75b8d7ccffb88285f6ec4911b196fd1a5fc3b6b0ec74924adba34e91308378847ac5baf84bdcf9e64fcebf45809ce98e
SSDEEP 196608:jdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:RadCoXrlAJ7N3pXW2uGzy
MD5 SHA1 SHA512 SSDEEP

Submit Download

lite_installer.exe

Path C:\Users\Admin\AppData\Local\Temp\8D314215-B82F-4AFE-8260-247227A01E40\lite_installer.exe
Size 419KB
SHA256 688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
MD5 aafdfaa7a989ddb216510fc9ae5b877f
SHA1 41cf94692968a7d511b6051b7fe2b15c784770cb
SHA512 6e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
SSDEEP 6144:bahey96oZyvBupY5/af/l27Y547CaPWJTfnOMhym0Wk57YG2F89UUZEfk7:bry96RvBj0C7CaPWNPrHCt9UUZa6
MD5 SHA1 SHA512 SSDEEP

Submit Download

YandexSearch00000.log

Path C:\Users\Admin\AppData\Local\Temp\YandexSearch00000.log
Size 1KB
SHA256 9524986a9d2b6a04ccdf40fbbce7a024085fba697249a5a24288c83a0b54f4c4
MD5 f319ea39ab59c91edfe04c08620bfbc6
SHA1 46b1732a90bbcf9eebfb25b9027eed550c8b1610
SHA512 2465aa5455864b934c7214bd1450e1f570591ca0a6d0dc614a52f4d5c60ec7855d5dce90ceb398af416d08d9c0a8ada4156668db7d0af355f253806c79df2b2a
MD5 SHA1 SHA512

Submit Download

aimware cracked.exe

Path C:\Users\Admin\AppData\Local\Temp\aimware cracked.exe
Size 10.6MB
SHA256 9f657ef4f8470c854769a9c43b1738171aa6d81050f50eea0e803905a73e8ac4
MD5 16620cf72e58b967961b6d2f5f1cdf83
SHA1 d584bbfce61a6d9a8d03a4e9976d9a52e5eb5b24
SHA512 96f416d13f717a8c133312be9c6a96ed23c2d17916474cebb20424c7343dfe982fabbf5f066ad5add1c9624ea4adfeac12b97a8d72bab5aa1c4e7527a5016f6d
SSDEEP 196608:Q55MZxmQI/Z2ZPaQ4+c3JMqCkOLmhL+P/9usexc+7fSy3:QU75I2Vayc3JM7KhL+PKcA6e
MD5 SHA1 SHA512 SSDEEP

Submit Download

deldll.bat

Path C:\Users\Admin\AppData\Local\Temp\deldll.bat
Size 200B
SHA256 9131de0fcaaf968896af9d58b6f37b4aa443455bb97c97bc142f295cee577bc4
MD5 ea190ef9b139757a890cd48bdd44b0ee
SHA1 95c684e41bf7919408816aafab881621fface202
SHA512 22802ffc1965c8e27f799ee88e3fa46debb316c27507a570b0812bc5de0d59a9c2a2105b8cc204851b3c29984ef1dfb7842131819952b185b7e4325a032fb6ad
MD5 SHA1 SHA512

Submit Download

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\genteeBA\guig.dll
Size 20KB
SHA256 005c251c21d6a5ba1c3281e7b9f3b4f684d007e0c3486b34a545bb370d8420aa
MD5 d3f8c0334c19198a109e44d074dac5fd
SHA1 167716989a62b25e9fcf8e20d78e390a52e12077
SHA512 9c890e0af5b20ce9db4284e726ec0b05b2a9f18b909fb8e595edf3348a8f0d07d5238d85446a09e72e4faa2e2875beb52742d312e5163f48df4072b982801b51
SSDEEP 192:mxonubPh9zJCEvCZj6beDKnYFRJvS/QwC3:tubPh9N6N6k3z
MD5 SHA1 SHA512 SSDEEP

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

omnija-20241213.zip

Path C:\Users\Admin\AppData\Local\Temp\omnija-20241213.zip
Size 4.9MB
SHA256 aeeeb9d3a66864eafda547e0f6047639d017c701824a62c49d2fe4de45be2017
MD5 fa66915afcd256926008a20fe34f3b75
SHA1 3cad946b4b11cb16bd483e73546d019c29fefeee
SHA512 1ba2ed3e5b7b7f8c0783507c4a636f28ba33ad591d452ca7c8251edeea089ef39ec638c9367b592c0dda73eb93e484cedd13bf7f8fa48de9cfc54eb81aa095a7
SSDEEP 49152:WR/flDJHmgBbPZis4PnsQ3MaEaxNutRaRfABoHrujJFap1jHPmAkWJlXziZIfFmZ:WEs4Psp//fq/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

vendor00000.xml

Path C:\Users\Admin\AppData\Local\Temp\vendor00000.xml
Size 508B
SHA256 0e50fab55969e8d00ca1d0a7ffd24ea614aef944a2d6dad578109937a200762e
MD5 9fc4c63e9ad343e8a45fd22bee2f5eb4
SHA1 87f865d5b60d3ed6175244e460b70ff5c373c4be
SHA512 932b46f108b1b8f41ea094ebfd18800990ada91e8f9af797048bf61d5877d4cf4dc1e6da393ba2168cd850265f8a20e5016baebf935780126c9b639e3cd141a2
MD5 SHA1 SHA512

Submit Download

YandexSearch.msi

Path C:\Users\Admin\AppData\Local\Temp\{5B964E0E-B9A3-4276-9ED9-4D5A5720747A}\YandexSearch.msi
Size 9.8MB
SHA256 22db2d018bc8ad91cbcdb9353af64c6063d2cefd2a8503b4464b7c64def60785
MD5 b78a1d41318c6f96defed8e74ca4a516
SHA1 cb39558ce386c3e0d7df0fbfaf4aa692630f11f1
SHA512 2d95a0038712c7fea79bdb5b7d5bf307ce894fcf1771194f77191d45ebd175c4adadcaddfa5208c9c0611706fd05f7c6a8d789538bb744cdb8d30933148f1fde
SSDEEP 196608:Odad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvqJ:CadCoXrlAJ7N3pXW2uGzyJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

YandexPackLoader.exe

Path C:\Users\Admin\AppData\Local\YandexPackLoader.exe
Size 728KB
SHA256 f1782058359784a2c34ea1c1f313caa3060a72c4c18e9bb7d760e40e6d095001
MD5 93627dc0563de52ffead32d29dab3bd0
SHA1 bded947f5374609606b06f70ce53ed4874a6a477
SHA512 4495bc5cad2b406364f44187138274271d3baa6eaead90f29e5957a5cddcd0d3e87c7d309608cb291635f2c173569dfbf75b35faceb1420f14ea860ce9a379bb
SSDEEP 12288:vLgtTrX65XVeLnt1iIMfxcxlR7UYIpsS8BNzVAbX3kW8jqZNpL7kB:vLwrX0gsFJcx37B7qZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\MSVCP140.dll
Size 558KB
SHA256 a88b8c1c8f27bf90fe960e0e8bd56984ad48167071af92d96ec1051f89f827fb
MD5 bf78c15068d6671693dfcdfa5770d705
SHA1 4418c03c3161706a4349dfe3f97278e7a5d8962a
SHA512 5b6b0ab4e82cc979eaa619d387c6995198fd19aa0c455bef44bd37a765685575d57448b3b4accd70d3bd20a6cd408b1f518eda0f6dae5aa106f225bee8291372
SSDEEP 12288:CZ+jZpQfIwKnkdmZJUbi7I0QfxK+pdd+cOj6LbndDrUw2K1fQEKZm+jWodEEVJaP:CEtmrdcK1fQEKZm+jWodEEb
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\VCRUNTIME140.dll
Size 94KB
SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
MD5 11d9ac94e8cb17bd23dea89f8e757f18
SHA1 d4fb80a512486821ad320c4fd67abcae63005158
SHA512 aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778
SSDEEP 1536:yDHLG4SsAzAvadZw+1Hcx8uIYNUzUnHg4becbK/zJrCT:yDrfZ+jPYNznHg4becbK/Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

cheatloader.exe

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\cheatloader.exe
Size 108KB
SHA256 3b6da10d0eca0ea8f1a28a4df08059555269828db3da3b0b4990681829d27ffa
MD5 3e15e73f6ecc61ef7eaacdee4686e607
SHA1 b76fbdc760285f0d652220e1a0b33fe3b188bd54
SHA512 9b2ddbf1c6b64084fc91de7dfa45ebb78ffcb1ee8f4b3ba3e6066fce34c1e36102187460049950741519044d6236e19b054e288f0c1a5177a5ade5c2b70c92e8
SSDEEP 3072:mATfSXka/JMC77cSGJSDCPaKI4AdEsC2bJT6hi+:mY0kaeQpePaKI4AdEsCM56hb
MD5 SHA1 SHA512 SSDEEP

Submit Download

app.so

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\data\app.so
Size 4.5MB
SHA256 498dd477a0ae5d531bb2fe67bcf351c3843aa05e19bbde975fb333b4d9ab200b
MD5 abbf126e8cb35b6e1c68d6abe919391b
SHA1 d70bee483bd7ef8d800a6f3a8b909a8219f6801b
SHA512 5dc418243d758fa615666f273af4aef1a46cba88a06b153f935c0b0b301a7867adedc0034aafef5a48a09a6424a66e61e5765a5b619a008ec4d04bcfe5f82d01
SSDEEP 49152:pP7o+93keljd2TKxuHucIfaN98rcU79f8Y4i1dVHfiqMUese6eU4yk+HXhd:p9FjNBdW
MD5 SHA1 SHA512 SSDEEP

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\data\flutter_assets\FontManifest.json
Size 499B
SHA256 eb4549732cd13d6c3874351c182ea15850fbf71f219fe1efe9a1cac19b6c9087
MD5 b2f01a90f24be87c4f4ae98e79090bf5
SHA1 ae7107f7e0d5fae6288e8a82cb1c0f67efbc0b3d
SHA512 422af00f1d8835598586687bec6162c52f6eb0234222f855301bceba8dd71a2bc0e720fa4148c360e77a44be97efc587dd3e2bef5c3cdece1a925f7cf93046ba
MD5 SHA1 SHA512

Submit Download

YandexBrowserLogo.svg

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\data\flutter_assets\assets\YandexBrowserLogo.svg
Size 1KB
SHA256 10c527dfb3c9521c4bbdff8d52c8ded04bcad20dbb4409c970a0cb2bd8a1f00d
MD5 8143f6880199b8e992edc37906737642
SHA1 5ea7b2e039ae202878f063da4ec06a58e78789c4
SHA512 1fe8695d8bef10cd4cbf07045dca3c6ec5ce93619a766ea5c18272301551b05ea55c5df52fa3d53be58cd7038c8bd38e188a6bc76f1b9449e298da4a95691655
MD5 SHA1 SHA512

Submit Download

Montserrat-Bold.ttf

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\data\flutter_assets\assets\fonts\Montserrat-Bold.ttf
Size 255KB
SHA256 c4c8cb572a5a2c43d78b3701f4b2349684e6ca4d1557e469af6065b1e099c26c
MD5 88932dadc42e1bba93b21a76de60ef7a
SHA1 3320ff5514b32565b0396de4f2064ce17ec9eea4
SHA512 298e1e171dbbe386e1abe153446b883c40910819099f64f54dc9faa95d739be56839537342bbe8dd8408545cb1f8c98878a3524d91af1f11a112d1bfc202657a
SSDEEP 3072:08h1Bpd66iuBwftuVF/N3lcV9EJvypyc/MwZ/kUOfGUByC5xxsZolHvBmctNt4hy:021BpdniVQ/1WPEJBikU2/JxZDvSQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gothampro_black.ttf

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\data\flutter_assets\assets\fonts\gothampro_black.ttf
Size 39KB
SHA256 270d30776b7e5ccf0560b08e0db009f4b1d9753d43689d1e20bb1065e2a3c157
MD5 efb0c02a5dbe65a7115b477e74c7a661
SHA1 e30324f4074bcc522a393cecaa62aa4b0e9205cc
SHA512 0095fb9b0cd508c996cfdc11374a040ef064a22f188d7fbeb21f23c5f7f06aa2bce75e9ae22ec1c0e0f1b8e23003f67c8e8b5962c224c1295fb311e63a9b91f4
SSDEEP 768:SGD1Qbcay0GSoIIooaPf6gkY8cHdNOL2GHXk1Fuzv2vU0D6hbTP7MX7ovAdBLv+x:Wcay0N8sOL2kk1FuzevU0D6hbTCBygMB
MD5 SHA1 SHA512 SSDEEP

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\data\icudtl.dat
Size 798KB
SHA256 ac44ccc3f61bf630bb20fb8043d86cfe4c8995d06b460084400db45d70497b30
MD5 cf772cf9f6ca67f592fe47da2a15adb1
SHA1 9cc4d99249bdba8a030daf00d98252c8aef7a0ff
SHA512 0bec0d3a34a4ac1cc2ed81dba3bc52981c5dd391a68fe21132dfadb70e42ffbe8f3ba798185733d64a900fd2bb2403f9a8558e6666f2c1e2c0e818d8e3f154fc
SSDEEP 12288:tMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtNdPHz982VWj8QM1q:Ehw3zVtjsbGu4RjxPHz6j8Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\flutter_windows.dll
Size 17.0MB
SHA256 80efad451cd0b674b9974ef286d29ef72f219999dd8f993585f9168d97895e6f
MD5 2eb35e2372de5fc7fde925c96de61d48
SHA1 a9eedd7cf44a6eab4e08df9ab0b33fd95ceb48fd
SHA512 18a03d297770707709fcada8dd0741bd39057d54b49125119ba8b7d21aa67284dece89947dc14721fe3084e69f03e816a2ed9ad79e82ffe279d7fd0a318ff029
SSDEEP 98304:isnKi051eTi9yvtKTtDr8jg49T79/LI/2lM4DTJuoaa+oMj9wky3U/pyEwYVqjTt:aiu1eyTd1Q7zaBj9wky3uw5grUjc9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140_1.dll

Path C:\Users\Admin\AppData\Roaming\Aimware cracked\vcruntime140_1.dll
Size 36KB
SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
MD5 7667b0883de4667ec87c3b75bed84d84
SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
SSDEEP 384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6D1D.tmp

Path C:\Windows\Installer\MSI6D1D.tmp
Size 181KB
SHA256 a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
MD5 0c80a997d37d930e7317d6dac8bb7ae1
SHA1 018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA512 fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
SSDEEP 3072:LIgxsEwKIE4SaX1xQrlm4taQqPvvNCqv8bcDR0wYyMP3XrZ+bx0PWWX+xA6QpS:LIgxsEbIE45ArptaQqPtCG8SR0waB7Bo
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI6D9B.tmp

Path C:\Windows\Installer\MSI6D9B.tmp
Size 189KB
SHA256 669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
MD5 e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA1 6a1b7f1a45fb578de6492af7e2fede15c866739f
SHA512 fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
SSDEEP 3072:iAJayVkvIkE3fqPDgvlevYwlv57GqosaJlpJKzhY9A3w9FtGJ2EYJxZi5V2O2M:ickvIDvWgvlevYwFVaJlp8z++bnYsX2Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 243ac2085da06bf8b4fecfb74f3b5a20d4cfdd5407fde23c21b8ed675cb6090a
MD5 ccbeec7f7cfa202892d0bd73379244d8
SHA1 71d1dab17212d3fcfad5f4d5e12b6069374acd41
SHA512 1dd5003e227fb71a15e02426260705aeecec616fc9396e07c0d8603ee2f9e45499e1258c54a00415a4779d3ccbaa9cdd5c130706244789ea57adecf2f196a169
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVWry99:UVqoCl/YgjxEufVU0TbTyDDal8u99
MD5 SHA1 SHA512 SSDEEP

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 f91f4cbcf2fa86f4c6a2b504cd586697bee567672d744444d055d371b4d424c1
MD5 b460c68755dd1245a07a218917d171cc
SHA1 da97ad4d84cac54c4c34f897d52d31ca69afa5a8
SHA512 cb4c958815eda73f9041f2ad15d18e160104531af7bfc98bced61466ca240ede625545801bddc7f3120ba03d7e3218fd159b1d6ad7f0d3d4ad3171e2a5a1f731
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVWry9Y:UVqoCl/YgjxEufVU0TbTyDDal8u9Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoolsv.exe

Path \??\c:\windows\resources\spoolsv.exe
Size 135KB
SHA256 1c5b92b0fc30b97415d31624a4f3d43c0f79856108ba9f53d26aa7d96ca5a84f
MD5 5ced1763b0be1a7b055f08a490ab563a
SHA1 5d0179a246846617f87a065fc22465c026fa28ab
SHA512 4e761da857bbc299f058721bd705f3824cd781c61523a4d5dd5816d95637e1ecdbf5ed15c273072460736628b636db81c0e0f027518db910dd2cc1a645c040ed
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVWry9P:UVqoCl/YgjxEufVU0TbTyDDal8u9P
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \??\c:\windows\resources\svchost.exe
Size 135KB
SHA256 4205e188b91f27290812034c9c70d052ed609f7d55d363667b203b8f66924509
MD5 c00f5e224a140088863c638c801cae75
SHA1 070ee90dc2e6e9042d4bf60dc9a8023375291bbf
SHA512 98405f185f5b13a99ec8d638bc24f054346b248ab482da730e9a1010486d4c43d56ff6c4f2724097c76153ee88779366259b4a9248f30a848b462a30f93d5fea
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVWry9h:UVqoCl/YgjxEufVU0TbTyDDal8u9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3036-125-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3256-112-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3256-124-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3316-123-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4508-91-0x0000018134870000-0x0000018134CE9000-memory.dmp

Download

memory/4508-92-0x0000018134870000-0x0000018134CE9000-memory.dmp

Download

memory/4508-89-0x0000018134780000-0x0000018134781000-memory.dmp

Download

memory/4508-93-0x0000018134790000-0x0000018134791000-memory.dmp

Download

memory/4508-90-0x0000018134870000-0x0000018134CE9000-memory.dmp

Download

memory/4592-126-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4592-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5036-117-0x0000000000400000-0x000000000041F000-memory.dmp

Download