Analysis

  • max time kernel
    419s
  • max time network
    421s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    23-06-2021 14:52

Errors

Reason
Remote task has failed: Machine shutdown

General

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies visibility of file extensions in Explorer 2 TTPs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 8 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 50 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:284
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2660
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://crackhomes.com
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:3972
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" https://crackhomes.com
          2⤵
          • Checks processor information in registry
          • NTFS ADS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.0.175407532\1030148282" -parentBuildID 20200403170909 -prefsHandle 1528 -prefMapHandle 1304 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 1604 gpu
            3⤵
              PID:2764
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.3.1813559663\1903893037" -childID 1 -isForBrowser -prefsHandle 2328 -prefMapHandle 2220 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 2340 tab
              3⤵
                PID:2116
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.13.302478400\1962720098" -childID 2 -isForBrowser -prefsHandle 3332 -prefMapHandle 3328 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 3316 tab
                3⤵
                  PID:4020
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.20.1229796221\714970934" -childID 3 -isForBrowser -prefsHandle 4312 -prefMapHandle 4232 -prefsLen 7784 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 4172 tab
                  3⤵
                    PID:4428
                  • C:\Program Files\Mozilla Firefox\uninstall\helper.exe
                    "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppUser
                    3⤵
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4580
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.27.739347950\1152185440" -childID 4 -isForBrowser -prefsHandle 4176 -prefMapHandle 4200 -prefsLen 8108 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 4064 tab
                    3⤵
                      PID:1192
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.34.1065409268\1204351869" -childID 5 -isForBrowser -prefsHandle 3988 -prefMapHandle 3928 -prefsLen 8108 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 4556 tab
                      3⤵
                        PID:4408
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.41.129662757\1320775481" -childID 6 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 8895 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 5188 tab
                        3⤵
                          PID:4784
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="800.48.75321760\521485536" -childID 7 -isForBrowser -prefsHandle 3560 -prefMapHandle 1464 -prefsLen 8895 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 800 "\\.\pipe\gecko-crash-server-pipe.800" 3880 tab
                          3⤵
                            PID:4208
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                        1⤵
                          PID:2636
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Browser
                          1⤵
                            PID:2556
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2376
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                            1⤵
                              PID:2336
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                              1⤵
                                PID:1944
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                1⤵
                                  PID:1408
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                  1⤵
                                    PID:1256
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                    1⤵
                                      PID:1216
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                      1⤵
                                        PID:1100
                                      • c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                        1⤵
                                        • Drops file in System32 directory
                                        PID:936
                                      • \??\c:\windows\system32\svchost.exe
                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                        1⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1896
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                          2⤵
                                          • Drops file in System32 directory
                                          • Checks processor information in registry
                                          • Modifies data under HKEY_USERS
                                          • Modifies registry class
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4664
                                      • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
                                        "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
                                        1⤵
                                        • Checks SCSI registry key(s)
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4700
                                      • C:\Windows\System32\rundll32.exe
                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                        1⤵
                                          PID:4368
                                        • C:\Program Files\7-Zip\7zG.exe
                                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\" -spe -an -ai#7zMap4474:102:7zEvent23488
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          PID:988
                                        • C:\Windows\system32\NOTEPAD.EXE
                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d-Passw0rd.txt
                                          1⤵
                                            PID:376
                                          • C:\Program Files\7-Zip\7zG.exe
                                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\" -spe -an -ai#7zMap9402:296:7zEvent20697
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            PID:5032
                                          • C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\setup_x86_x64_install.exe
                                            "C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\setup_x86_x64_install.exe"
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5024
                                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2672
                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\setup_install.exe
                                                "C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\setup_install.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2132
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                                  4⤵
                                                    PID:4744
                                                    • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_3.exe
                                                      arnatic_3.exe
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      PID:1420
                                                      • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                        6⤵
                                                        • Loads dropped DLL
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3560
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                                    4⤵
                                                      PID:4704
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_5.exe
                                                        arnatic_5.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1524
                                                        • C:\Users\Admin\AppData\Roaming\6375432.exe
                                                          "C:\Users\Admin\AppData\Roaming\6375432.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          PID:4400
                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                            7⤵
                                                            • Executes dropped EXE
                                                            PID:5320
                                                        • C:\Users\Admin\AppData\Roaming\1777945.exe
                                                          "C:\Users\Admin\AppData\Roaming\1777945.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4944
                                                        • C:\Users\Admin\AppData\Roaming\2972918.exe
                                                          "C:\Users\Admin\AppData\Roaming\2972918.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4984
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                      4⤵
                                                        PID:340
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                          arnatic_7.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:680
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            PID:3692
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4740
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c arnatic_8.exe
                                                        4⤵
                                                          PID:988
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_8.exe
                                                            arnatic_8.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4196
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c arnatic_6.exe
                                                          4⤵
                                                            PID:4460
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c arnatic_4.exe
                                                            4⤵
                                                              PID:4864
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c arnatic_2.exe
                                                              4⤵
                                                                PID:4748
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c arnatic_1.exe
                                                                4⤵
                                                                  PID:4492
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_6.exe
                                                            arnatic_6.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:4992
                                                            • C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe
                                                              "C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks processor information in registry
                                                              PID:5684
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im ZxFIOn_Ng13y8LFUwYbc1chf.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe" & del C:\ProgramData\*.dll & exit
                                                                3⤵
                                                                  PID:4528
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /im ZxFIOn_Ng13y8LFUwYbc1chf.exe /f
                                                                    4⤵
                                                                    • Kills process with taskkill
                                                                    PID:2740
                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                    timeout /t 6
                                                                    4⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:5764
                                                              • C:\Users\Admin\Documents\v7XdAA9YBtZonOfPUqAJmwdf.exe
                                                                "C:\Users\Admin\Documents\v7XdAA9YBtZonOfPUqAJmwdf.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Checks BIOS information in registry
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5732
                                                              • C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe
                                                                "C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Checks processor information in registry
                                                                PID:5748
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im ZlmjxMexvqKUuB0JhPeiMaev.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe" & del C:\ProgramData\*.dll & exit
                                                                  3⤵
                                                                    PID:1828
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /im ZlmjxMexvqKUuB0JhPeiMaev.exe /f
                                                                      4⤵
                                                                      • Kills process with taskkill
                                                                      PID:4036
                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                      timeout /t 6
                                                                      4⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:4896
                                                                • C:\Users\Admin\Documents\XoFkZ2Tjbwbsdzl7lHtebPfV.exe
                                                                  "C:\Users\Admin\Documents\XoFkZ2Tjbwbsdzl7lHtebPfV.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  PID:5824
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 660
                                                                    3⤵
                                                                    • Drops file in Windows directory
                                                                    • Program crash
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5536
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 676
                                                                    3⤵
                                                                    • Program crash
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4568
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 664
                                                                    3⤵
                                                                    • Program crash
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:5528
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 700
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:4836
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1040
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:5764
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1256
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:2076
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1324
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:6092
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1416
                                                                    3⤵
                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                    • Program crash
                                                                    PID:5476
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 1476
                                                                    3⤵
                                                                    • Program crash
                                                                    PID:1492
                                                                • C:\Users\Admin\Documents\ZdWz1oISd9pI4ETvRtKmdPgn.exe
                                                                  "C:\Users\Admin\Documents\ZdWz1oISd9pI4ETvRtKmdPgn.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  PID:5836
                                                                  • C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe
                                                                    "C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:4748
                                                                    • C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe
                                                                      "C:\Program Files (x86)\Browzar\NVdpapR9v21C.exe"
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:2228
                                                                  • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                    "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Checks whether UAC is enabled
                                                                    PID:5892
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5892 -s 2596
                                                                      4⤵
                                                                      • Program crash
                                                                      PID:5368
                                                                • C:\Users\Admin\Documents\MeyUhQsz8c_YBoG4b4B7yASO.exe
                                                                  "C:\Users\Admin\Documents\MeyUhQsz8c_YBoG4b4B7yASO.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  PID:5872
                                                                  • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                    "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:5484
                                                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:3860
                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                      4⤵
                                                                        PID:6052
                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                        4⤵
                                                                          PID:2228
                                                                      • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                        "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Checks computer location settings
                                                                        PID:5436
                                                                        • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                          "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                          4⤵
                                                                          • Loads dropped DLL
                                                                          PID:2668
                                                                      • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Checks whether UAC is enabled
                                                                        • Drops file in Program Files directory
                                                                        PID:5576
                                                                    • C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe
                                                                      "C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5928
                                                                      • C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe
                                                                        C:\Users\Admin\Documents\Rl6_LZwlHWu_4sGEBW9lU3TN.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        PID:5692
                                                                    • C:\Users\Admin\Documents\3xK7933E6oFUpw9WpCLlzHkg.exe
                                                                      "C:\Users\Admin\Documents\3xK7933E6oFUpw9WpCLlzHkg.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:5980
                                                                    • C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe
                                                                      "C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6044
                                                                      • C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe
                                                                        C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks processor information in registry
                                                                        PID:5716
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im _CDDfk1YnZNqH8zkqupf13JG.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\_CDDfk1YnZNqH8zkqupf13JG.exe" & del C:\ProgramData\*.dll & exit
                                                                          4⤵
                                                                            PID:3516
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im _CDDfk1YnZNqH8zkqupf13JG.exe /f
                                                                              5⤵
                                                                              • Kills process with taskkill
                                                                              PID:5036
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 6
                                                                              5⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:4924
                                                                      • C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe
                                                                        "C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:5888
                                                                        • C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe
                                                                          C:\Users\Admin\Documents\d8UE1Z51rF02pkMR0HASp44l.exe
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:5668
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 24
                                                                            4⤵
                                                                            • Program crash
                                                                            PID:200
                                                                      • C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe
                                                                        "C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe"
                                                                        2⤵
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        PID:5200
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                          3⤵
                                                                          • Enumerates system info in registry
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:1076
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xe4,0xe8,0xec,0x7c,0xf0,0x7ffbc1f04f50,0x7ffbc1f04f60,0x7ffbc1f04f70
                                                                            4⤵
                                                                              PID:4020
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1888 /prefetch:8
                                                                              4⤵
                                                                                PID:5636
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1876 /prefetch:8
                                                                                4⤵
                                                                                  PID:5076
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1824 /prefetch:2
                                                                                  4⤵
                                                                                    PID:3096
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2600 /prefetch:1
                                                                                    4⤵
                                                                                      PID:5520
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
                                                                                      4⤵
                                                                                        PID:5664
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                                                                                        4⤵
                                                                                          PID:5616
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
                                                                                          4⤵
                                                                                            PID:3188
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                                                                                            4⤵
                                                                                              PID:1964
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
                                                                                              4⤵
                                                                                                PID:5760
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,15745192659410495209,18040400670355298462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8
                                                                                                4⤵
                                                                                                  PID:2084
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "cmd.exe" /C taskkill /F /PID 5200 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe"
                                                                                                3⤵
                                                                                                  PID:1000
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /F /PID 5200
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:5620
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "cmd.exe" /C taskkill /F /PID 5200 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\D9OHjqIwIVRyI5vFizY0DKLI.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:6052
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /F /PID 5200
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    PID:5012
                                                                                              • C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe
                                                                                                "C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3884
                                                                                                • C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe
                                                                                                  "C:\Users\Admin\Documents\pz3OGPMJLz27c5CyifMuMYx6.exe"
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  PID:4672
                                                                                              • C:\Users\Admin\Documents\Q8NAXtrxoylrXjJCNK1iHcMA.exe
                                                                                                "C:\Users\Admin\Documents\Q8NAXtrxoylrXjJCNK1iHcMA.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Checks computer location settings
                                                                                                • Modifies registry class
                                                                                                PID:5280
                                                                                                • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                                                                  3⤵
                                                                                                  • Loads dropped DLL
                                                                                                  PID:3064
                                                                                              • C:\Users\Admin\Documents\rGdPj3fL041nagUY7dg1izMD.exe
                                                                                                "C:\Users\Admin\Documents\rGdPj3fL041nagUY7dg1izMD.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:5128
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  3⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:6104
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  3⤵
                                                                                                    PID:2228
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_2.exe
                                                                                                arnatic_2.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                PID:3820
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_4.exe
                                                                                                arnatic_4.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:376
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4384
                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:6112
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_1.exe
                                                                                                arnatic_1.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Checks processor information in registry
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:4828
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_1.exe" & del C:\ProgramData\*.dll & exit
                                                                                                  2⤵
                                                                                                    PID:3504
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      taskkill /im arnatic_1.exe /f
                                                                                                      3⤵
                                                                                                      • Kills process with taskkill
                                                                                                      PID:2628
                                                                                                    • C:\Windows\SysWOW64\timeout.exe
                                                                                                      timeout /t 6
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:3868
                                                                                                • C:\Windows\system32\werfault.exe
                                                                                                  werfault.exe /h /shared Global\c80c8351ee474942813ab16260fb6143 /t 1860 /p 3008
                                                                                                  1⤵
                                                                                                    PID:6068
                                                                                                  • C:\Windows\system32\taskmgr.exe
                                                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                                                    1⤵
                                                                                                    • Checks SCSI registry key(s)
                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    PID:6120
                                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                    1⤵
                                                                                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                    PID:5100
                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                    1⤵
                                                                                                      PID:5844
                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                        2⤵
                                                                                                        • Checks processor information in registry
                                                                                                        • Modifies registry class
                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        PID:4112
                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.0.862220334\865236648" -parentBuildID 20200403170909 -prefsHandle 1472 -prefMapHandle 1464 -prefsLen 1 -prefMapSize 220413 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 1524 gpu
                                                                                                          3⤵
                                                                                                            PID:5032
                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.3.1725119642\740040684" -childID 1 -isForBrowser -prefsHandle 5152 -prefMapHandle 5148 -prefsLen 397 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 5164 tab
                                                                                                            3⤵
                                                                                                              PID:6108
                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.13.783671645\1702720206" -childID 2 -isForBrowser -prefsHandle 2668 -prefMapHandle 2704 -prefsLen 6628 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2736 tab
                                                                                                              3⤵
                                                                                                                PID:5188
                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.20.240203191\811431848" -childID 3 -isForBrowser -prefsHandle 2620 -prefMapHandle 2844 -prefsLen 6628 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2748 tab
                                                                                                                3⤵
                                                                                                                  PID:5004
                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.27.1513101391\1117425437" -childID 4 -isForBrowser -prefsHandle 2348 -prefMapHandle 2444 -prefsLen 7411 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2748 tab
                                                                                                                  3⤵
                                                                                                                    PID:4744
                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4112.34.228737146\545575952" -childID 5 -isForBrowser -prefsHandle 7212 -prefMapHandle 7376 -prefsLen 7526 -prefMapSize 220413 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 4112 "\\.\pipe\gecko-crash-server-pipe.4112" 2000 tab
                                                                                                                    3⤵
                                                                                                                      PID:5780
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2940.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\2940.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5648
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\48AB.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\48AB.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Writes to the Master Boot Record (MBR)
                                                                                                                  PID:4964

                                                                                                                Network

                                                                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                Persistence

                                                                                                                Modify Existing Service

                                                                                                                1
                                                                                                                T1031

                                                                                                                Hidden Files and Directories

                                                                                                                2
                                                                                                                T1158

                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                1
                                                                                                                T1060

                                                                                                                Bootkit

                                                                                                                1
                                                                                                                T1067

                                                                                                                Defense Evasion

                                                                                                                Modify Registry

                                                                                                                5
                                                                                                                T1112

                                                                                                                Disabling Security Tools

                                                                                                                1
                                                                                                                T1089

                                                                                                                Hidden Files and Directories

                                                                                                                2
                                                                                                                T1158

                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                1
                                                                                                                T1497

                                                                                                                Credential Access

                                                                                                                Credentials in Files

                                                                                                                3
                                                                                                                T1081

                                                                                                                Discovery

                                                                                                                Query Registry

                                                                                                                7
                                                                                                                T1012

                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                1
                                                                                                                T1497

                                                                                                                System Information Discovery

                                                                                                                7
                                                                                                                T1082

                                                                                                                Peripheral Device Discovery

                                                                                                                1
                                                                                                                T1120

                                                                                                                Collection

                                                                                                                Data from Local System

                                                                                                                3
                                                                                                                T1005

                                                                                                                Command and Control

                                                                                                                Web Service

                                                                                                                1
                                                                                                                T1102

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\arnatic_7.exe.log
                                                                                                                  MD5

                                                                                                                  808e884c00533a9eb0e13e64960d9c3a

                                                                                                                  SHA1

                                                                                                                  279d05181fc6179a12df1a669ff5d8b64c1380ae

                                                                                                                  SHA256

                                                                                                                  2f6a0aab99b1c228a6642f44f8992646ce84c5a2b3b9941b6cf1f2badf67bdd6

                                                                                                                  SHA512

                                                                                                                  9489bdb2ffdfeef3c52edcfe9b34c6688eba53eb86075e0564df1cd474723c86b5b5aedc12df1ff5fc12cf97bd1e3cf9701ff61dc4ce90155d70e9ccfd0fc299

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_1.exe
                                                                                                                  MD5

                                                                                                                  c897c97805e7272dab2b6de4d8ca11e3

                                                                                                                  SHA1

                                                                                                                  f50877b8a5415849709120e98a3645cb13e59536

                                                                                                                  SHA256

                                                                                                                  c8f94aebce54d870cbc0515cc1ffdaec8e6a62f825783fdf95df01497169cd3d

                                                                                                                  SHA512

                                                                                                                  594e700f72fff5148ee567c078a5415be1dd6552fd7b30ba1f7b748ed1b422267df00ade1152cd029a9e0bb9fd75d52df33a85c35efaf6903e6a435e46c712ff

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_1.txt
                                                                                                                  MD5

                                                                                                                  c897c97805e7272dab2b6de4d8ca11e3

                                                                                                                  SHA1

                                                                                                                  f50877b8a5415849709120e98a3645cb13e59536

                                                                                                                  SHA256

                                                                                                                  c8f94aebce54d870cbc0515cc1ffdaec8e6a62f825783fdf95df01497169cd3d

                                                                                                                  SHA512

                                                                                                                  594e700f72fff5148ee567c078a5415be1dd6552fd7b30ba1f7b748ed1b422267df00ade1152cd029a9e0bb9fd75d52df33a85c35efaf6903e6a435e46c712ff

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_2.exe
                                                                                                                  MD5

                                                                                                                  bf8ebc95739a919f3fe451245ea8889a

                                                                                                                  SHA1

                                                                                                                  5084c19cf34a2ace91a9addcca962263cfb948de

                                                                                                                  SHA256

                                                                                                                  a09e16a99d0a7506d8107f35738a4ead25441629585d9fffb672b47ce6b05a51

                                                                                                                  SHA512

                                                                                                                  65546332ab0abf00cdea4e17221d3df8b7bffc288a54dbe65a91b7fd16605ff1e9b8afc7b722b00a4b9222e7b8a8e28b37d3ac65bd1f3f9455dfd081a9085a12

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_2.txt
                                                                                                                  MD5

                                                                                                                  bf8ebc95739a919f3fe451245ea8889a

                                                                                                                  SHA1

                                                                                                                  5084c19cf34a2ace91a9addcca962263cfb948de

                                                                                                                  SHA256

                                                                                                                  a09e16a99d0a7506d8107f35738a4ead25441629585d9fffb672b47ce6b05a51

                                                                                                                  SHA512

                                                                                                                  65546332ab0abf00cdea4e17221d3df8b7bffc288a54dbe65a91b7fd16605ff1e9b8afc7b722b00a4b9222e7b8a8e28b37d3ac65bd1f3f9455dfd081a9085a12

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_3.exe
                                                                                                                  MD5

                                                                                                                  7837314688b7989de1e8d94f598eb2dd

                                                                                                                  SHA1

                                                                                                                  889ae8ce433d5357f8ea2aff64daaba563dc94e3

                                                                                                                  SHA256

                                                                                                                  d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

                                                                                                                  SHA512

                                                                                                                  3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_3.txt
                                                                                                                  MD5

                                                                                                                  7837314688b7989de1e8d94f598eb2dd

                                                                                                                  SHA1

                                                                                                                  889ae8ce433d5357f8ea2aff64daaba563dc94e3

                                                                                                                  SHA256

                                                                                                                  d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247

                                                                                                                  SHA512

                                                                                                                  3df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_4.exe
                                                                                                                  MD5

                                                                                                                  5668cb771643274ba2c375ec6403c266

                                                                                                                  SHA1

                                                                                                                  dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                  SHA256

                                                                                                                  d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                  SHA512

                                                                                                                  135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_4.txt
                                                                                                                  MD5

                                                                                                                  5668cb771643274ba2c375ec6403c266

                                                                                                                  SHA1

                                                                                                                  dd78b03428b99368906fe62fc46aaaf1db07a8b9

                                                                                                                  SHA256

                                                                                                                  d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384

                                                                                                                  SHA512

                                                                                                                  135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_5.exe
                                                                                                                  MD5

                                                                                                                  7074003838ec7c6d4d2cf720dda468a0

                                                                                                                  SHA1

                                                                                                                  cfc4aa29ab56b69ef9fcc7433345dbb79035e5ef

                                                                                                                  SHA256

                                                                                                                  a986c290d627ff81e0d8bbb5be5b6bbefd0f6c49f068e1710ac3c6bf088b10f0

                                                                                                                  SHA512

                                                                                                                  b6984d82d6cc80dbfd451f8ba330156fc5c1de6b9406b03cdedd33a4d8a1f90aba2c64137cbdccaff6ef6445f03d688d22d15222e050307d7d7d1514dbd612a1

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_5.txt
                                                                                                                  MD5

                                                                                                                  7074003838ec7c6d4d2cf720dda468a0

                                                                                                                  SHA1

                                                                                                                  cfc4aa29ab56b69ef9fcc7433345dbb79035e5ef

                                                                                                                  SHA256

                                                                                                                  a986c290d627ff81e0d8bbb5be5b6bbefd0f6c49f068e1710ac3c6bf088b10f0

                                                                                                                  SHA512

                                                                                                                  b6984d82d6cc80dbfd451f8ba330156fc5c1de6b9406b03cdedd33a4d8a1f90aba2c64137cbdccaff6ef6445f03d688d22d15222e050307d7d7d1514dbd612a1

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_6.exe
                                                                                                                  MD5

                                                                                                                  33d711ccfe4a4e9cbd37c99e25c13769

                                                                                                                  SHA1

                                                                                                                  781e0cdc5b1c72f217f54bedd2c2862c73604e89

                                                                                                                  SHA256

                                                                                                                  5d500524991ad1e6178b097b7ee5e270eef3710115b72a424b7fb2643490f992

                                                                                                                  SHA512

                                                                                                                  2de7c4e5672f52da356ba80e132d9eb93a51290d43ebbe35471a72c2872ab7648880f0240ea94b0fce27d604c1a45964ab50ebe7256403900b22d7a59e0160c5

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_6.txt
                                                                                                                  MD5

                                                                                                                  33d711ccfe4a4e9cbd37c99e25c13769

                                                                                                                  SHA1

                                                                                                                  781e0cdc5b1c72f217f54bedd2c2862c73604e89

                                                                                                                  SHA256

                                                                                                                  5d500524991ad1e6178b097b7ee5e270eef3710115b72a424b7fb2643490f992

                                                                                                                  SHA512

                                                                                                                  2de7c4e5672f52da356ba80e132d9eb93a51290d43ebbe35471a72c2872ab7648880f0240ea94b0fce27d604c1a45964ab50ebe7256403900b22d7a59e0160c5

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                                                                                  MD5

                                                                                                                  cfb846afa58b9a2fb8018e55ef841f90

                                                                                                                  SHA1

                                                                                                                  8a6bfe762bf3093b1fff0211752a34dc5ee57319

                                                                                                                  SHA256

                                                                                                                  92f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6

                                                                                                                  SHA512

                                                                                                                  73344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                                                                                  MD5

                                                                                                                  cfb846afa58b9a2fb8018e55ef841f90

                                                                                                                  SHA1

                                                                                                                  8a6bfe762bf3093b1fff0211752a34dc5ee57319

                                                                                                                  SHA256

                                                                                                                  92f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6

                                                                                                                  SHA512

                                                                                                                  73344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.exe
                                                                                                                  MD5

                                                                                                                  cfb846afa58b9a2fb8018e55ef841f90

                                                                                                                  SHA1

                                                                                                                  8a6bfe762bf3093b1fff0211752a34dc5ee57319

                                                                                                                  SHA256

                                                                                                                  92f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6

                                                                                                                  SHA512

                                                                                                                  73344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_7.txt
                                                                                                                  MD5

                                                                                                                  cfb846afa58b9a2fb8018e55ef841f90

                                                                                                                  SHA1

                                                                                                                  8a6bfe762bf3093b1fff0211752a34dc5ee57319

                                                                                                                  SHA256

                                                                                                                  92f609f0932717ebf8ad7b9b3f049348d10f74442864e146dec3150cc684baf6

                                                                                                                  SHA512

                                                                                                                  73344d00671fc365c6ac091524a975e67f5243590badff7c5253ee2c44a1944d60e801a0282218014941139bb59044c23372f802beca57559bbe76d61a002df1

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_8.exe
                                                                                                                  MD5

                                                                                                                  6273cc1a2ea3106c0b574ed43764835e

                                                                                                                  SHA1

                                                                                                                  bf2f5f50ab28d4d50ee8d252ce5db16fd489a75b

                                                                                                                  SHA256

                                                                                                                  0b8436983a48aa0ee3b5e99e9a51f06270f0f56f816eabc68a5466a187270601

                                                                                                                  SHA512

                                                                                                                  49b09495bdabae1360dba5e606a6cebc5327f35b61c7a6e068bf2ecf6ed809da5b77e4f10129f76a835c6edddefe58e92b57c227f48df0821d738eaae9649f03

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\arnatic_8.txt
                                                                                                                  MD5

                                                                                                                  6273cc1a2ea3106c0b574ed43764835e

                                                                                                                  SHA1

                                                                                                                  bf2f5f50ab28d4d50ee8d252ce5db16fd489a75b

                                                                                                                  SHA256

                                                                                                                  0b8436983a48aa0ee3b5e99e9a51f06270f0f56f816eabc68a5466a187270601

                                                                                                                  SHA512

                                                                                                                  49b09495bdabae1360dba5e606a6cebc5327f35b61c7a6e068bf2ecf6ed809da5b77e4f10129f76a835c6edddefe58e92b57c227f48df0821d738eaae9649f03

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\libcurl.dll
                                                                                                                  MD5

                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                  SHA1

                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                  SHA256

                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                  SHA512

                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\libcurlpp.dll
                                                                                                                  MD5

                                                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                  SHA1

                                                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                  SHA256

                                                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                  SHA512

                                                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\libgcc_s_dw2-1.dll
                                                                                                                  MD5

                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                  SHA1

                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                  SHA256

                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                  SHA512

                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\libstdc++-6.dll
                                                                                                                  MD5

                                                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                                                  SHA1

                                                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                  SHA256

                                                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                  SHA512

                                                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\libwinpthread-1.dll
                                                                                                                  MD5

                                                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                  SHA1

                                                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                  SHA256

                                                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                  SHA512

                                                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\setup_install.exe
                                                                                                                  MD5

                                                                                                                  38b1353e139cd981e1a9fd49a04a21d4

                                                                                                                  SHA1

                                                                                                                  4a372bba42d4da8c955cd0ac48a0f6a45a501b67

                                                                                                                  SHA256

                                                                                                                  4c80500b1950704084034dbcff40a7415a5c3326a5c29aff5790f4741fdfdeae

                                                                                                                  SHA512

                                                                                                                  4b96bbb32352ac610920b0b5452da6267eef07ad0660cfd28f6afe889ee79039bbb01cd37a50faf059ebc11b2a2a6e07ef00ed374d79ce6c955299cfdbc3d11a

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS07AA8766\setup_install.exe
                                                                                                                  MD5

                                                                                                                  38b1353e139cd981e1a9fd49a04a21d4

                                                                                                                  SHA1

                                                                                                                  4a372bba42d4da8c955cd0ac48a0f6a45a501b67

                                                                                                                  SHA256

                                                                                                                  4c80500b1950704084034dbcff40a7415a5c3326a5c29aff5790f4741fdfdeae

                                                                                                                  SHA512

                                                                                                                  4b96bbb32352ac610920b0b5452da6267eef07ad0660cfd28f6afe889ee79039bbb01cd37a50faf059ebc11b2a2a6e07ef00ed374d79ce6c955299cfdbc3d11a

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dat
                                                                                                                  MD5

                                                                                                                  13abe7637d904829fbb37ecda44a1670

                                                                                                                  SHA1

                                                                                                                  de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f

                                                                                                                  SHA256

                                                                                                                  7a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6

                                                                                                                  SHA512

                                                                                                                  6e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                  MD5

                                                                                                                  89c739ae3bbee8c40a52090ad0641d31

                                                                                                                  SHA1

                                                                                                                  d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

                                                                                                                  SHA256

                                                                                                                  10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

                                                                                                                  SHA512

                                                                                                                  cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                  MD5

                                                                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                                                                  SHA1

                                                                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                                                                  SHA256

                                                                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                                                                  SHA512

                                                                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                  MD5

                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                  SHA1

                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                  SHA256

                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                  SHA512

                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                  MD5

                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                  SHA1

                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                  SHA256

                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                  SHA512

                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                  MD5

                                                                                                                  061957baa0d1a66d82e35b5bd134cf1e

                                                                                                                  SHA1

                                                                                                                  f3579736a742c7796f2f3aa5181cff1a776f94cc

                                                                                                                  SHA256

                                                                                                                  57928562beabdb20fc273facff087f462c1f40b120fd1da663ec3ad8252d0c6b

                                                                                                                  SHA512

                                                                                                                  400bd135a83bdab13526f115519cdc6713d9ebb1534e295f9bf32f86d560d5735160053b77c985b11cc5613ae07e212383b79462485c3e8cba9d8520c4adb8b6

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                  MD5

                                                                                                                  061957baa0d1a66d82e35b5bd134cf1e

                                                                                                                  SHA1

                                                                                                                  f3579736a742c7796f2f3aa5181cff1a776f94cc

                                                                                                                  SHA256

                                                                                                                  57928562beabdb20fc273facff087f462c1f40b120fd1da663ec3ad8252d0c6b

                                                                                                                  SHA512

                                                                                                                  400bd135a83bdab13526f115519cdc6713d9ebb1534e295f9bf32f86d560d5735160053b77c985b11cc5613ae07e212383b79462485c3e8cba9d8520c4adb8b6

                                                                                                                • C:\Users\Admin\AppData\Roaming\1777945.exe
                                                                                                                  MD5

                                                                                                                  b898ca9b0c9b92e730008b46a603bb62

                                                                                                                  SHA1

                                                                                                                  32ab15bfc57ece9a75a53b40fbe6330c43109573

                                                                                                                  SHA256

                                                                                                                  aa1c31f18ab25f995591a15e173055aa04c1680c5bc52ea9466458dbaada90d5

                                                                                                                  SHA512

                                                                                                                  1d15387e1a73fb9336885748d9ca1d60d4fceeee0805b9628b3be8f51681c61d527b8dff3f127377057f5efd313e9af905b4e0797cf9e7df7d278a63807c4d9f

                                                                                                                • C:\Users\Admin\AppData\Roaming\1777945.exe
                                                                                                                  MD5

                                                                                                                  b898ca9b0c9b92e730008b46a603bb62

                                                                                                                  SHA1

                                                                                                                  32ab15bfc57ece9a75a53b40fbe6330c43109573

                                                                                                                  SHA256

                                                                                                                  aa1c31f18ab25f995591a15e173055aa04c1680c5bc52ea9466458dbaada90d5

                                                                                                                  SHA512

                                                                                                                  1d15387e1a73fb9336885748d9ca1d60d4fceeee0805b9628b3be8f51681c61d527b8dff3f127377057f5efd313e9af905b4e0797cf9e7df7d278a63807c4d9f

                                                                                                                • C:\Users\Admin\AppData\Roaming\2972918.exe
                                                                                                                  MD5

                                                                                                                  dbc3e30b19977c8673c130723a66f3ca

                                                                                                                  SHA1

                                                                                                                  25bf782e7d8de01b58e008f9374c28b282931258

                                                                                                                  SHA256

                                                                                                                  e7bdef11fa5adbe33ccd5b7484f3519fa23a25800c11999043d86a4107991d40

                                                                                                                  SHA512

                                                                                                                  d8c54d47172defeb409a89b6d50189e6681634a1241e4e8e86dfae5f2338b35a94df39720c7a77ac8173cf7ebb35ce132049c3047e5a40c5f3b06679ab3b8fa5

                                                                                                                • C:\Users\Admin\AppData\Roaming\2972918.exe
                                                                                                                  MD5

                                                                                                                  dbc3e30b19977c8673c130723a66f3ca

                                                                                                                  SHA1

                                                                                                                  25bf782e7d8de01b58e008f9374c28b282931258

                                                                                                                  SHA256

                                                                                                                  e7bdef11fa5adbe33ccd5b7484f3519fa23a25800c11999043d86a4107991d40

                                                                                                                  SHA512

                                                                                                                  d8c54d47172defeb409a89b6d50189e6681634a1241e4e8e86dfae5f2338b35a94df39720c7a77ac8173cf7ebb35ce132049c3047e5a40c5f3b06679ab3b8fa5

                                                                                                                • C:\Users\Admin\AppData\Roaming\6375432.exe
                                                                                                                  MD5

                                                                                                                  99d5457bb72ed6c353595e20b1e20267

                                                                                                                  SHA1

                                                                                                                  9616199a48917be415e27a43ff7e7b31acc85d43

                                                                                                                  SHA256

                                                                                                                  ca6fb0a62174ced80b8e2dccacf10f402246c5a817adc4462656fd991deb902c

                                                                                                                  SHA512

                                                                                                                  d6acfe3b91f0ab40b816e51cca81d15f3945fb33eb506c6939aeb5c0d2f7fe8327387ae6d1a0bafe00c857d51ff6daaa145e5cffa08dfdd801226f602dd80640

                                                                                                                • C:\Users\Admin\AppData\Roaming\6375432.exe
                                                                                                                  MD5

                                                                                                                  99d5457bb72ed6c353595e20b1e20267

                                                                                                                  SHA1

                                                                                                                  9616199a48917be415e27a43ff7e7b31acc85d43

                                                                                                                  SHA256

                                                                                                                  ca6fb0a62174ced80b8e2dccacf10f402246c5a817adc4462656fd991deb902c

                                                                                                                  SHA512

                                                                                                                  d6acfe3b91f0ab40b816e51cca81d15f3945fb33eb506c6939aeb5c0d2f7fe8327387ae6d1a0bafe00c857d51ff6daaa145e5cffa08dfdd801226f602dd80640

                                                                                                                • C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58.zip
                                                                                                                  MD5

                                                                                                                  0a6799d611604e6eb78c6daedca23f15

                                                                                                                  SHA1

                                                                                                                  5aa07869d7f8103ca2646d03573a5d5a7288f865

                                                                                                                  SHA256

                                                                                                                  a08024f5807ea11357a180093bcbd0fc859e848ddb9de49a004af12f45ab9d34

                                                                                                                  SHA512

                                                                                                                  7229995ce71c2d9d3d5cc2960f0fdf88b4855b59fbb96a35b5f0ef69d5ce166b0af1a32e2ffe0e118b34da72adf1e8e045ca2a567d663690b9c5bedd46eaa353

                                                                                                                • C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d-Passw0rd.txt
                                                                                                                  MD5

                                                                                                                  3e769592a83504baa8f5ba87149b4f4b

                                                                                                                  SHA1

                                                                                                                  3bee2d2b8776ae1cd66045667e9e08c637c88990

                                                                                                                  SHA256

                                                                                                                  35e094c09725d0c8263d7f04ce022f94380b07785c2efbe58cc15bb462d00b2a

                                                                                                                  SHA512

                                                                                                                  7bfab843e2a322143707d9f74aff9b7d381c836c89de59bce239d151cead935beda5266da3169629684a7dba023f1f4c7098c1914448754bf529276d54d2adcd

                                                                                                                • C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall.zip
                                                                                                                  MD5

                                                                                                                  f388b39b14ec956badfb1e143fd264cf

                                                                                                                  SHA1

                                                                                                                  84614af8801aaaf80c8772da90dd66e972362c54

                                                                                                                  SHA256

                                                                                                                  453f5bc191495d4a67f790b9ebd9d1b35f22a2ef1107b84651521854a5483249

                                                                                                                  SHA512

                                                                                                                  a1cfb4daebfa3a4a01467436c1f59396a60de2e5a33caf16575df43ba1376e4103d5e4eed7515efeb95ae305f8b6caf107a6635777dd02a492152e1c5ac48f7e

                                                                                                                • C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\setup_x86_x64_install.exe
                                                                                                                  MD5

                                                                                                                  58f6ddcf1c6a0cfd5b73d3a3d07efe80

                                                                                                                  SHA1

                                                                                                                  6c625d1dcca2c2231ca96d7e85cd827387db580d

                                                                                                                  SHA256

                                                                                                                  6cdb9151ae6298471877c56f3e96238db6d438dd8518515c1468245be11fab61

                                                                                                                  SHA512

                                                                                                                  115f039e70990decbdfd0f2043dd55bce9e225871349b2fdfddeb08ac87373769c7f35619de5d212617fde92f0f5cd86b48c624f38d9dd04e083745cb7fb2eed

                                                                                                                • C:\Users\Admin\Desktop\60d353_CCleaner-Pro-58\CCleaner-Pro-5828950-Crack---License-Key-Latest-Version-2021\60d353c3dc9f260d353c3d_setupInstall\setup_x86_x64_install.exe
                                                                                                                  MD5

                                                                                                                  58f6ddcf1c6a0cfd5b73d3a3d07efe80

                                                                                                                  SHA1

                                                                                                                  6c625d1dcca2c2231ca96d7e85cd827387db580d

                                                                                                                  SHA256

                                                                                                                  6cdb9151ae6298471877c56f3e96238db6d438dd8518515c1468245be11fab61

                                                                                                                  SHA512

                                                                                                                  115f039e70990decbdfd0f2043dd55bce9e225871349b2fdfddeb08ac87373769c7f35619de5d212617fde92f0f5cd86b48c624f38d9dd04e083745cb7fb2eed

                                                                                                                • C:\Users\Admin\Documents\XoFkZ2Tjbwbsdzl7lHtebPfV.exe
                                                                                                                  MD5

                                                                                                                  663fdf847d6b11308415ff86ebffc275

                                                                                                                  SHA1

                                                                                                                  6167fdf3cd9a585a44f24eb15d414281edad2485

                                                                                                                  SHA256

                                                                                                                  820194153174a679179e3649a4ebac8f39b4fefd2836d19ae1241e4e520fae26

                                                                                                                  SHA512

                                                                                                                  26fd3d57c229eebfbce364c9d2e77ae65199b147241d1f101c57a54441ffe196b216ad83ab4037293f8b4dd01380baa580b6bc359ded84256a7e65788acaa859

                                                                                                                • C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe
                                                                                                                  MD5

                                                                                                                  3fa93feb10f08753f207064325ee1274

                                                                                                                  SHA1

                                                                                                                  7672832f47f788cd4bf4ee9e25596e993fa7c872

                                                                                                                  SHA256

                                                                                                                  1ad251a6045588eafb69a8a60504563d02dcc3fcedbe64b6cdbad3586e2a064e

                                                                                                                  SHA512

                                                                                                                  cb2fb58e6896bd3902316618804afd910ece180a33b73e695171ec7424828f16be526cfb2f5e6284435cf077bef2dd6f2b895343f40ec1329d075bd940a185f0

                                                                                                                • C:\Users\Admin\Documents\ZlmjxMexvqKUuB0JhPeiMaev.exe
                                                                                                                  MD5

                                                                                                                  3fa93feb10f08753f207064325ee1274

                                                                                                                  SHA1

                                                                                                                  7672832f47f788cd4bf4ee9e25596e993fa7c872

                                                                                                                  SHA256

                                                                                                                  1ad251a6045588eafb69a8a60504563d02dcc3fcedbe64b6cdbad3586e2a064e

                                                                                                                  SHA512

                                                                                                                  cb2fb58e6896bd3902316618804afd910ece180a33b73e695171ec7424828f16be526cfb2f5e6284435cf077bef2dd6f2b895343f40ec1329d075bd940a185f0

                                                                                                                • C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe
                                                                                                                  MD5

                                                                                                                  e95903faa7fa411b824570e6fdbf8b83

                                                                                                                  SHA1

                                                                                                                  ce143431da41dacf23547b7fad77b43f04e80d56

                                                                                                                  SHA256

                                                                                                                  8be9cec521fca3b82e924f94f7d13b253a9259c0ead8cabc4a71cd26d2ca8b7b

                                                                                                                  SHA512

                                                                                                                  a60e8557ad12d57d29dfa6977a738688201baa32e727b1422c164de7c28de65d39bbff729773859cdde6ad1274ec37ce5b3b081c7421ec46d2724cc3a9d68853

                                                                                                                • C:\Users\Admin\Documents\ZxFIOn_Ng13y8LFUwYbc1chf.exe
                                                                                                                  MD5

                                                                                                                  e95903faa7fa411b824570e6fdbf8b83

                                                                                                                  SHA1

                                                                                                                  ce143431da41dacf23547b7fad77b43f04e80d56

                                                                                                                  SHA256

                                                                                                                  8be9cec521fca3b82e924f94f7d13b253a9259c0ead8cabc4a71cd26d2ca8b7b

                                                                                                                  SHA512

                                                                                                                  a60e8557ad12d57d29dfa6977a738688201baa32e727b1422c164de7c28de65d39bbff729773859cdde6ad1274ec37ce5b3b081c7421ec46d2724cc3a9d68853

                                                                                                                • C:\Users\Admin\Documents\v7XdAA9YBtZonOfPUqAJmwdf.exe
                                                                                                                  MD5

                                                                                                                  a518f41d6fb67a8bc68aa077c1a59bc0

                                                                                                                  SHA1

                                                                                                                  e0d97b7c823e9f9b5689042634e948a209e940ee

                                                                                                                  SHA256

                                                                                                                  714a30085b93988295ea7b732d24384db7bb3be843e20acd447ae8dd258db7a8

                                                                                                                  SHA512

                                                                                                                  c269df71096904eb8b9386224e22cebc8d182ef6c1caa07aadf1cacea9be545fd37f4f9d5f67d0b419a15b46263c60278c6541b6a2a0cb0473e5dd93e732dd1e

                                                                                                                • C:\Users\Admin\Documents\v7XdAA9YBtZonOfPUqAJmwdf.exe
                                                                                                                  MD5

                                                                                                                  a518f41d6fb67a8bc68aa077c1a59bc0

                                                                                                                  SHA1

                                                                                                                  e0d97b7c823e9f9b5689042634e948a209e940ee

                                                                                                                  SHA256

                                                                                                                  714a30085b93988295ea7b732d24384db7bb3be843e20acd447ae8dd258db7a8

                                                                                                                  SHA512

                                                                                                                  c269df71096904eb8b9386224e22cebc8d182ef6c1caa07aadf1cacea9be545fd37f4f9d5f67d0b419a15b46263c60278c6541b6a2a0cb0473e5dd93e732dd1e

                                                                                                                • \??\pipe\chrome.800.53.167804133
                                                                                                                  MD5

                                                                                                                  c8a7a2309a9c7d7b5f641a1b474529ae

                                                                                                                  SHA1

                                                                                                                  376b3abf47950f66326c03cf715b8688c0d5a5e7

                                                                                                                  SHA256

                                                                                                                  fa9e044ced67634b76dcdb94f0e2307ab31413d0bbcedcd13cd8aa9ff9050c9b

                                                                                                                  SHA512

                                                                                                                  eb4a93587c3dc1404f324db4d6e4b5f733ae51e14856217cce89fc4418fd4a9974f10ff7d0e25baf4825b94ad0384a07826197c60023c7e84d6ae6ca73fd75fb

                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS07AA8766\libcurl.dll
                                                                                                                  MD5

                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                  SHA1

                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                  SHA256

                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                  SHA512

                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS07AA8766\libcurl.dll
                                                                                                                  MD5

                                                                                                                  d09be1f47fd6b827c81a4812b4f7296f

                                                                                                                  SHA1

                                                                                                                  028ae3596c0790e6d7f9f2f3c8e9591527d267f7

                                                                                                                  SHA256

                                                                                                                  0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

                                                                                                                  SHA512

                                                                                                                  857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS07AA8766\libcurlpp.dll
                                                                                                                  MD5

                                                                                                                  e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                  SHA1

                                                                                                                  b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                  SHA256

                                                                                                                  43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                  SHA512

                                                                                                                  9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS07AA8766\libgcc_s_dw2-1.dll
                                                                                                                  MD5

                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                  SHA1

                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                  SHA256

                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                  SHA512

                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS07AA8766\libgcc_s_dw2-1.dll
                                                                                                                  MD5

                                                                                                                  9aec524b616618b0d3d00b27b6f51da1

                                                                                                                  SHA1

                                                                                                                  64264300801a353db324d11738ffed876550e1d3

                                                                                                                  SHA256

                                                                                                                  59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

                                                                                                                  SHA512

                                                                                                                  0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS07AA8766\libstdc++-6.dll
                                                                                                                  MD5

                                                                                                                  5e279950775baae5fea04d2cc4526bcc

                                                                                                                  SHA1

                                                                                                                  8aef1e10031c3629512c43dd8b0b5d9060878453

                                                                                                                  SHA256

                                                                                                                  97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

                                                                                                                  SHA512

                                                                                                                  666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

                                                                                                                • \Users\Admin\AppData\Local\Temp\7zS07AA8766\libwinpthread-1.dll
                                                                                                                  MD5

                                                                                                                  1e0d62c34ff2e649ebc5c372065732ee

                                                                                                                  SHA1

                                                                                                                  fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                                                                                                  SHA256

                                                                                                                  509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                                                                                                  SHA512

                                                                                                                  3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                                                                                                • \Users\Admin\AppData\Local\Temp\axhub.dll
                                                                                                                  MD5

                                                                                                                  89c739ae3bbee8c40a52090ad0641d31

                                                                                                                  SHA1

                                                                                                                  d0f7dc9a0a3e52af0f9f9736f26e401636c420a1

                                                                                                                  SHA256

                                                                                                                  10a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d

                                                                                                                  SHA512

                                                                                                                  cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480

                                                                                                                • \Users\Admin\AppData\Local\Temp\nso36A7.tmp\CityHash.dll
                                                                                                                  MD5

                                                                                                                  737379945745bb94f8a0dadcc18cad8d

                                                                                                                  SHA1

                                                                                                                  6a1f497b4dc007f5935b66ec83b00e5a394332c6

                                                                                                                  SHA256

                                                                                                                  d3d7b3d7a7941d66c7f75257be90b12ac76f787af42cd58f019ce0280972598a

                                                                                                                  SHA512

                                                                                                                  c4a43b3ca42483cbd117758791d4333ddf38fa45eb3377f7b71ce74ec6e4d8b5ef2bfbe48c249d4eaf57ab929f4301138e53c79e0fa4be94dcbcd69c8046bc22

                                                                                                                • \Users\Admin\AppData\Local\Temp\nso36A7.tmp\CityHash.dll
                                                                                                                  MD5

                                                                                                                  737379945745bb94f8a0dadcc18cad8d

                                                                                                                  SHA1

                                                                                                                  6a1f497b4dc007f5935b66ec83b00e5a394332c6

                                                                                                                  SHA256

                                                                                                                  d3d7b3d7a7941d66c7f75257be90b12ac76f787af42cd58f019ce0280972598a

                                                                                                                  SHA512

                                                                                                                  c4a43b3ca42483cbd117758791d4333ddf38fa45eb3377f7b71ce74ec6e4d8b5ef2bfbe48c249d4eaf57ab929f4301138e53c79e0fa4be94dcbcd69c8046bc22

                                                                                                                • \Users\Admin\AppData\Local\Temp\nso36A7.tmp\System.dll
                                                                                                                  MD5

                                                                                                                  17ed1c86bd67e78ade4712be48a7d2bd

                                                                                                                  SHA1

                                                                                                                  1cc9fe86d6d6030b4dae45ecddce5907991c01a0

                                                                                                                  SHA256

                                                                                                                  bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

                                                                                                                  SHA512

                                                                                                                  0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

                                                                                                                • memory/284-246-0x000001E9D2720000-0x000001E9D2791000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/340-188-0x0000000000000000-mapping.dmp
                                                                                                                • memory/376-199-0x0000000000000000-mapping.dmp
                                                                                                                • memory/680-210-0x00000000050B0000-0x00000000050B1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/680-196-0x0000000000000000-mapping.dmp
                                                                                                                • memory/680-206-0x0000000000810000-0x0000000000811000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/800-114-0x0000000000000000-mapping.dmp
                                                                                                                • memory/936-307-0x000001FCFCFD0000-0x000001FCFD041000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/988-189-0x0000000000000000-mapping.dmp
                                                                                                                • memory/1100-286-0x0000022791B30000-0x0000022791BA1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/1192-133-0x0000000000000000-mapping.dmp
                                                                                                                • memory/1216-301-0x00000219A3B00000-0x00000219A3B71000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/1256-299-0x000001CB5A8D0000-0x000001CB5A941000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/1408-292-0x000002490C840000-0x000002490C8B1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/1420-191-0x0000000000000000-mapping.dmp
                                                                                                                • memory/1524-208-0x00000000009E0000-0x00000000009E1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/1524-203-0x0000000000890000-0x0000000000891000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/1524-197-0x0000000000000000-mapping.dmp
                                                                                                                • memory/1524-212-0x000000001B670000-0x000000001B672000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/1524-209-0x0000000000D00000-0x0000000000D20000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  128KB

                                                                                                                • memory/1524-211-0x00000000009F0000-0x00000000009F1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/1896-260-0x00000254322F0000-0x0000025432361000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/1944-296-0x0000021E26FD0000-0x0000021E27041000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/2116-121-0x0000000000000000-mapping.dmp
                                                                                                                • memory/2132-178-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                • memory/2132-169-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                • memory/2132-168-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                • memory/2132-167-0x0000000000400000-0x000000000051E000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  1.1MB

                                                                                                                • memory/2132-166-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  152KB

                                                                                                                • memory/2132-165-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  1.5MB

                                                                                                                • memory/2132-164-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  572KB

                                                                                                                • memory/2132-149-0x0000000000000000-mapping.dmp
                                                                                                                • memory/2132-180-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  100KB

                                                                                                                • memory/2336-254-0x0000022D32210000-0x0000022D32281000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/2376-263-0x0000028914880000-0x00000289148F1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/2556-236-0x000001833F0D0000-0x000001833F141000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/2556-226-0x000001833E830000-0x000001833E87C000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  304KB

                                                                                                                • memory/2636-305-0x000002BC90080000-0x000002BC900F1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/2660-306-0x000001D1896C0000-0x000001D189731000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/2672-146-0x0000000000000000-mapping.dmp
                                                                                                                • memory/2764-116-0x0000000000000000-mapping.dmp
                                                                                                                • memory/3008-347-0x00000000066A0000-0x00000000066B6000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  88KB

                                                                                                                • memory/3064-368-0x0000000000000000-mapping.dmp
                                                                                                                • memory/3560-223-0x0000000000CEB000-0x0000000000DEC000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  1.0MB

                                                                                                                • memory/3560-216-0x0000000000000000-mapping.dmp
                                                                                                                • memory/3560-228-0x0000000000C20000-0x0000000000C7D000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  372KB

                                                                                                                • memory/3820-336-0x0000000000400000-0x00000000008F8000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                • memory/3820-193-0x0000000000000000-mapping.dmp
                                                                                                                • memory/3820-326-0x0000000000A30000-0x0000000000B7A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  1.3MB

                                                                                                                • memory/3860-363-0x0000000000000000-mapping.dmp
                                                                                                                • memory/3884-343-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4020-124-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4196-340-0x0000000002604000-0x0000000002606000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/4196-339-0x0000000002603000-0x0000000002604000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4196-334-0x0000000002600000-0x0000000002601000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4196-337-0x0000000000400000-0x000000000090A000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                • memory/4196-202-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4196-335-0x0000000002602000-0x0000000002603000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4196-332-0x0000000000AA0000-0x0000000000ACF000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  188KB

                                                                                                                • memory/4208-139-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4384-213-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4400-258-0x0000000004C00000-0x0000000004C01000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4400-241-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4400-264-0x0000000004C60000-0x0000000004C70000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/4400-266-0x000000000DB50000-0x000000000DB51000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4400-282-0x0000000002590000-0x0000000002591000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4400-249-0x00000000004A0000-0x00000000004A1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4408-135-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4428-126-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4460-187-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4492-179-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4580-127-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4580-131-0x0000000002250000-0x000000000225F000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  60KB

                                                                                                                • memory/4664-352-0x000001DA02920000-0x000001DA0293B000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  108KB

                                                                                                                • memory/4664-353-0x000001DA03900000-0x000001DA03A06000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  1.0MB

                                                                                                                • memory/4664-243-0x000001DA01100000-0x000001DA01171000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  452KB

                                                                                                                • memory/4664-224-0x00007FF7AA974060-mapping.dmp
                                                                                                                • memory/4704-185-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4740-285-0x00000000057C0000-0x00000000057C1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4740-271-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  120KB

                                                                                                                • memory/4740-293-0x00000000057E0000-0x00000000057E1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4740-287-0x0000000005860000-0x0000000005861000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4740-274-0x0000000000417F26-mapping.dmp
                                                                                                                • memory/4740-283-0x0000000005E70000-0x0000000005E71000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4740-297-0x0000000005850000-0x0000000005851000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4744-182-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4748-181-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4748-361-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4784-137-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4828-184-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4828-327-0x0000000000400000-0x000000000094D000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  5.3MB

                                                                                                                • memory/4828-324-0x0000000002560000-0x00000000025FD000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  628KB

                                                                                                                • memory/4864-183-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4944-255-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4944-265-0x0000000000A70000-0x0000000000A71000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4944-303-0x0000000005360000-0x0000000005361000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4944-280-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4984-267-0x00000000053B0000-0x00000000053E1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  196KB

                                                                                                                • memory/4984-229-0x0000000000000000-mapping.dmp
                                                                                                                • memory/4984-247-0x0000000005490000-0x0000000005491000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4984-237-0x0000000000B80000-0x0000000000B81000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4984-270-0x0000000007B20000-0x0000000007B21000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/4992-190-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5128-345-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5200-344-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5280-346-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5320-348-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5320-351-0x0000000004D60000-0x0000000004D61000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/5436-364-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5484-362-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5576-365-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5668-355-0x0000000000417E2E-mapping.dmp
                                                                                                                • memory/5684-342-0x0000000000400000-0x00000000004BA000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  744KB

                                                                                                                • memory/5684-341-0x00000000020F0000-0x000000000218D000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  628KB

                                                                                                                • memory/5684-308-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5692-354-0x0000000000417E36-mapping.dmp
                                                                                                                • memory/5692-358-0x0000000005760000-0x0000000005D66000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  6.0MB

                                                                                                                • memory/5716-357-0x0000000000400000-0x00000000004A1000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  644KB

                                                                                                                • memory/5716-356-0x000000000046B76D-mapping.dmp
                                                                                                                • memory/5732-331-0x0000000003030000-0x0000000003031000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/5732-320-0x0000000077D20000-0x0000000077EAE000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  1.6MB

                                                                                                                • memory/5732-311-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5748-312-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5824-317-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5824-350-0x0000000000400000-0x0000000000472000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  456KB

                                                                                                                • memory/5824-349-0x0000000002090000-0x00000000020BF000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  188KB

                                                                                                                • memory/5836-318-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5872-321-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5888-322-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5888-329-0x00000000053B0000-0x00000000058AE000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                • memory/5892-366-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5928-323-0x0000000000000000-mapping.dmp
                                                                                                                • memory/5928-338-0x00000000058A0000-0x0000000005D9E000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                • memory/5980-325-0x0000000000000000-mapping.dmp
                                                                                                                • memory/6044-333-0x0000000005460000-0x000000000595E000-memory.dmp
                                                                                                                  Filesize

                                                                                                                  5.0MB

                                                                                                                • memory/6044-328-0x0000000000000000-mapping.dmp
                                                                                                                • memory/6052-367-0x0000000000000000-mapping.dmp
                                                                                                                • memory/6104-360-0x0000000000000000-mapping.dmp
                                                                                                                • memory/6112-330-0x0000000000000000-mapping.dmp
                                                                                                                • memory/6120-359-0x0000000000000000-mapping.dmp